PDF malware analysis — malicious · d618089ef18dc245

MALICIOUS

PDF

45.3 KB Created: 2021-05-15 15:43:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 6e67cc9fa7657d67bd993d63cb9d7499 SHA-1: 789f4a58ad74d060a9aa018fda968b8e688fdc5c SHA-256: d618089ef18dc245b18261c25033138eb983aa89d6c2b041c3dc3cd56a41cfec

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and heuristics indicating it is designed to trick users into downloading malicious content, likely by impersonating offers for free in-game items. The presence of a download button lure and password archive instructions further support this malicious intent. No scripts were extracted, but the embedded URLs suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9507

Heuristics 4

Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-limiteds-roblox-game-hack
- http://londiniumcentre.com/images/free-spins-for-coin-master-2021_GM406889139.pdf
- http://londiniumcentre.com/images/how-to-get-free-robux-easy-no-download_GM431946152.pdf
- http://londiniumcentre.com/images/hack-coins-in-coin-master_GM406889139.pdf
- http://londiniumcentre.com/images/robux-app_GM431946152.pdf
- http://londiniumcentre.com/images/robux-free-com_GM431946152.pdf
- http://londiniumcentre.com/images/no-scam-free-robux_GM431946152.pdf
- http://londiniumcentre.com/images/coin-master-village-4_GM406889139.pdf
- http://londiniumcentre.com/images/op-rewards-free-robux_GM431946152.pdf
- http://londiniumcentre.com/images/coin-master-free-spin-and-coin_GM406889139.pdf
- http://londiniumcentre.com/images/roblox-free-hair-girl_GM431946152.pdf
- http://londiniumcentre.com/images/free-robux-com_GM431946152.pdf
- http://londiniumcentre.com/images/free-robux-roblox-promo-codes_GM431946152.pdf
- http://londiniumcentre.com/images/free-coin-master-spins-links-2021_GM406889139.pdf
- http://londiniumcentre.com/images/how-to-win-robux_GM431946152.pdf
- http://londiniumcentre.com/images/coin-master-free-spins-cheat-deutsch_GM406889139.pdf
- http://londiniumcentre.com/images/coin-master-links-free-spins_GM406889139.pdf
- http://londiniumcentre.com/images/coin-master-hack-program_GM406889139.pdf
- http://londiniumcentre.com/images/coin-master-free-spins-link-2021_GM406889139.pdf
- http://londiniumcentre.com/images/coin-master-hack-version-download-ios_GM406889139.pdf
- http://londiniumcentre.com/images/robux-hacks-2021_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004734.bin` `84cf783094554575ada713f7fe3d252fa1268757412becebcb583b78803b5697`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4734	25040 bytes
`font_01_sfnt_off000080ac.bin` `450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x80AC	5696 bytes
`font_02_sfnt_off00008dbd.bin` `cd6e3b888b69b87eccf2bd9bf0eaf83aa01cccd071b198ee6fa00879ae765b94`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DBD	18604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.