PDF malware analysis — malicious · fcfa462e43bf3d82

MALICIOUS

PDF

49.3 KB Created: 2021-05-16 16:05:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 49324668c15cb38676045aac55598672 SHA-1: d2041a7eb17ebe91c6b373b31007e92c41a755a0 SHA-256: fcfa462e43bf3d8288eddd68d6c12d302820316c895fcef8558918c879c91613

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body, though partially corrupted, contains a URL related to game hacks, suggesting a lure for potentially malicious downloads or scams. The presence of embedded URIs and the ML classifier output strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.8642

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/how-to-get-free-pets-in-adopt-me-roblox-game-hack
- https://www.prodex-holz.cz/images/daily-free-spins-coin-master_GM406889139.pdf
- https://www.prodex-holz.cz/images/hacks-to-get-free-robux_GM431946152.pdf
- https://www.prodex-holz.cz/images/roblox-com-free-robux_GM431946152.pdf
- https://www.prodex-holz.cz/images/coin-master-free-spins-link-deutsch-ios_GM406889139.pdf
- https://www.prodex-holz.cz/images/free-roblox-clothes-and-hair_GM431946152.pdf
- https://www.prodex-holz.cz/images/free-roblox-promo-codes-for-robux_GM431946152.pdf
- https://www.prodex-holz.cz/images/free-spins-on-coin-master-without-human-verification_GM406889139.pdf
- https://www.prodex-holz.cz/images/coin-master-daily-free-spins-link-today_GM406889139.pdf
- https://www.prodex-holz.cz/images/hack-crack-for-coin-master-currency_GM406889139.pdf
- https://www.prodex-holz.cz/images/get-free-robux-no-verification_GM431946152.pdf
- https://www.prodex-holz.cz/images/robuxy-com-free-robux_GM431946152.pdf
- https://www.prodex-holz.cz/images/coin-master-hack-using-cheat-engine_GM406889139.pdf
- https://www.prodex-holz.cz/images/free-robux-generator-no-human-verification-2021_GM431946152.pdf
- https://www.prodex-holz.cz/images/is-it-possible-to-get-free-robux_GM431946152.pdf
- https://www.prodex-holz.cz/images/coin-master-hack-apk-with-fb-login_GM406889139.pdf
- https://www.prodex-holz.cz/images/free-robux-promo-codes-2021_GM431946152.pdf
- https://www.prodex-holz.cz/images/can-you-host-a-minecraft-server-for-free_GM479516143.pdf
- https://www.prodex-holz.cz/images/free-robux-no-survey_GM431946152.pdf
- https://www.prodex-holz.cz/images/how-to-get-free-robux-easy-hack_GM431946152.pdf
- https://www.prodex-holz.cz/images/websites-to-get-free-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004bd1.bin` `c18c0b06ec13e78bd8c967ab626cc82a46d36d8dc761074c8c076a2d17c60679`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4BD1	25172 bytes
`font_01_sfnt_off000085f7.bin` `94c1b019735d7e491765340abe50b2897410e2ec65ecf141c08bd9f2220897c4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x85F7	2824 bytes
`font_02_sfnt_off00008fa0.bin` `9a13c2580265a78e8a7257496a31ee0055738af7e20a5661c2902efe4bf05ce5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8FA0	5596 bytes
`font_03_sfnt_off00009c48.bin` `ddf32d21812ca42913bb48f22a0284a59638f2c0abe9b9b8a3ace66687a9859d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9C48	18916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.