PDF malware analysis — malicious · eac5ce86514447d5

MALICIOUS

PDF

31.2 KB Created: 2021-06-09 12:09:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 452fe753529c6a69406b9f5e4ac9f14f SHA-1: b8880d2ce1f36fff35c9b6849fbbab4158103cb3 SHA-256: eac5ce86514447d547bd672f6c4b2514e01d337d3d8fa391876263bb093882f4

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous links to external websites, many of which are SEO-optimized PDFs promising game cheats and currency. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms a large number of external links designed to attract traffic. The primary attack pattern is likely a lure to drive users to potentially malicious sites or download further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/how-to-get-free-robux-no-human-verification-website-game-hack
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-hack-with-lucky-patcher_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/minecraft-windows-10-free-code_GM479516143.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-free-spins-youthnow_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/free-robux-microsoft_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-attack-hack_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-free-spins-link-2021-today_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-hack-tool-access-online-generator_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/free-vip-server-roblox_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-daily-free-spins-link-today-haktuts_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/free-roblox-girl-hair-not-a-model_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/how-to-give-robux-on-mobile_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/free-tiktok-followers-no-downloads_GM835599320.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/free-robux-gen_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/free-robux-generator-without-verification_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/robux-page_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/how-to-hack-roblox-to-get-free-robux_GM431946152.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/haktuts-2021-coin-master-free-spin-link_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-free-daily-spins_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-free-spins-haktuts_GM406889139.pdf
- https://sitecontabil.com.br/ckfinder/userfiles/files/coin-master-hack-app-for-ios_GM406889139.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005198.bin` `1ee45f94c2e87495c1751499524a019bba1a96a6163d17eaa77387a89535c8fc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5198	18739 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.