PDF malware analysis — malicious · d478fd91f678b0f5

MALICIOUS

PDF

41.6 KB Created: 2021-05-17 08:37:52 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: f1ad284923f30cdbea8ed5595922b2e1 SHA-1: 0f0e732516894ef668803df5554a96f1da454d28 SHA-256: d478fd91f678b0f573f5b937495cd69d5daa8eaa44eddc1c8a3ba04729af518d

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document contains multiple embedded URLs and a visual download button lure, suggesting it is designed to trick users into downloading further malicious content. The ML classifier strongly indicates malicious intent, and the presence of external URIs and an IP literal points to a download or redirection mechanism. The document body's content about 'Coin Master Game Hacking Tricks' is a common lure for distributing malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-game-hacking-tricks-game-hack
- http://118.174.0.244/UserFiles/File/coinmaster-spin-ml-free_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/how-to-get-free-robux-2021_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/coin-master-hack-apk-35-13_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/coin-master-hack-spins-apk-download_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/coin-master-free-spin-link-new_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/free-robux-real-working_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/how-to-get-free-coins-in-coin-master_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/clients-minecraft_GM479516143.pdf
- http://118.174.0.244/UserFiles/File/how-to-get-free-robux-without-offers_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/how-can-i-play-minecraft-for-free_GM479516143.pdf
- http://118.174.0.244/UserFiles/File/coin-master-free-spins-hack_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/robux-hack-2021_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/pig-master-free-spins-and-coins_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/roblox-lovenet_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/free-robux-co_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/robux-generator-no-human-verification-2021_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/coin-spin-link_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/how-to-get-free-robux-fast-and-easy_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/a-lot-of-robux_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/coin-master-blogspot_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off0000492c.bin` `524ca0318fae0ede4a8b1490b27b10e3cb46ab9c73651a66466dceb1d5114d9c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x492C	24120 bytes
`font_01_sfnt_off00008064.bin` `e6eeb4c177e5eee4d6ed34054a731a6c1f0233db213bcc63fafd9e052183041d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8064	18264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.