PDF malware analysis — malicious · d09e8407952baae5

MALICIOUS

PDF

46.4 KB Created: 2021-05-19 00:33:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: d8762ad7afa3934a678760f9e438599c SHA-1: 73ed38b041c4b9a1ed60d97a04087bf337124d69 SHA-256: d09e8407952baae53c4e5c3c84c442cfa1dd76419a0aeba612bc693c7b096a38

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains lures for free in-game currency and items, specifically mentioning Roblox and Coin Master. It includes external URIs pointing to domains associated with these lures, suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.8948

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-roblox-accounts-with-robux-game-hack
- http://julo-it.net/images/free-robux-for-free_GM431946152.pdf
- http://julo-it.net/images/free-minecraft-gift-codes_GM479516143.pdf
- http://julo-it.net/images/free-robux-without-doing-anything_GM431946152.pdf
- http://julo-it.net/images/hack-my-game-xyz-coin-master_GM406889139.pdf
- http://julo-it.net/images/free-robux-com-roblox_GM431946152.pdf
- http://julo-it.net/images/coin-master-free-spins-and-coins-2021_GM406889139.pdf
- http://julo-it.net/images/coin-master-hack-without-verification-for-iphone_GM406889139.pdf
- http://julo-it.net/images/how-to-hack-coin-master-game-ios_GM406889139.pdf
- http://julo-it.net/images/minecraft-modded-client_GM479516143.pdf
- http://julo-it.net/images/roblox-gift-card-free-codes_GM431946152.pdf
- http://julo-it.net/images/free-robux-no-human-verification-generator_GM431946152.pdf
- http://julo-it.net/images/roblox-zone-free-robux_GM431946152.pdf
- http://julo-it.net/images/coin-master-32-hack-apk_GM406889139.pdf
- http://julo-it.net/images/download-hacked-games-com-coin-master_GM406889139.pdf
- http://julo-it.net/images/free-spins-coins-coin-master_GM406889139.pdf
- http://julo-it.net/images/will-minecraft-dungeons-be-free_GM479516143.pdf
- http://julo-it.net/images/coin-master-rewards-app_GM406889139.pdf
- http://julo-it.net/images/wurst-115_GM479516143.pdf
- http://julo-it.net/images/coin-master-free-raid-link_GM406889139.pdf
- http://julo-it.net/images/how-do-i-get-free-spins-in-coin-master_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004ae0.bin` `3c0161848d5ef5f373bfa2fd885a079abaf28a601d9c9347bf2a3bc5bbc16e34`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4AE0	25828 bytes
`font_01_sfnt_off000086ac.bin` `4b3e0f36ad1e0c7e3ea5c178fd2b4f097d1e01575fc6a4101a8b520db34dfe07`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x86AC	3400 bytes
`font_02_sfnt_off000091d6.bin` `4ebcf990001f3b6d5b8f187221ce9c528a6bcbfca241b55ad06a715c23028265`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x91D6	18676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.