PDF malware analysis — malicious · e36041b2e9bfec4b

MALICIOUS

PDF

42.9 KB Created: 2021-05-16 01:00:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-04

MD5: c2a0cfb637a648d502dfb493c73e1d83 SHA-1: a757bff88aa074d4a01a9a2d319edd162c4a09c8 SHA-256: e36041b2e9bfec4b139e4509a42dfd45ef68192ab2c75244919f119f872e306c

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded links and a visual download button, directing users to potentially malicious content related to game hacks and in-game currency. The ML classifier strongly flagged this PDF as malicious, and a critical heuristic identified a link to known malicious redirector infrastructure. The document body, though partially corrupted, contains references to 'Hack Coin Master Apk' and 'Robux', suggesting a lure for users seeking cheats or exploits.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/hack-coin-master-apk-3.2-game-hack In PDF document text
- https://uofk.edu/images/robuxmatchcon_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/how-do-you-get-free-robux-without-doing-anything_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/minecraft-free-minecraft_GM479516143.pdfIn PDF document text
- https://uofk.edu/images/free-robux-images_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/coin-master-free-spins-2021_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/coin-master-free-spin-and-coins-links-2021_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/hack-roblox-players_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/robux-free-com_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/how-do-you-get-free-robux-without-paying_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/roblox-cp_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/roblox-jailbreak-hack_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/coin-master-hack-tool-exe_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/free-robux-generator-no-survey_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/free-spin-link-coin-master_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/coin-master-hack-generator_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/coin-master-free-spin-codes_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/coin-master-hack-apk-download-for-android-mobile_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/how-do-you-get-free-roblox-money_GM431946152.pdfIn PDF document text
- https://uofk.edu/images/www-coinmaster_GM406889139.pdfIn PDF document text
- https://uofk.edu/images/www-roblox-com-free-robux_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off0000499b.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x499B	26212 bytes
SHA-256: `c5f7f4e013f058857e369ccef8a39847d28391ec382b4a3133603fa4d0ba1f80`
`font_01_sfnt_off00008540.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8540	18256 bytes
SHA-256: `2de3a067c92fd750cac538864d09afc8d4d9cd3de69932c6374fba6ea057edab`

Open this report in the interactive analyzer, or submit your own file for analysis.