PDF static analysis report

Static analysis result for SHA-256 01a026eb77f8d479…

SUSPICIOUS

PDF

35.0 KB Created: 2021-07-05 13:05:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: bac859df6787833fb3dab7bef49354a6 SHA-1: 18d947b43a356341c70461f519972b76822f97d1 SHA-256: 01a026eb77f8d47984b61df4a299ff032baa102f9dfb975557518b2cebc2a661
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a prominent call-to-action related to hacking popular games like Coin Master and Roblox. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of it being used for malicious purposes, likely to distribute malware or lead users to phishing sites. No scripts were extracted, but the presence of multiple suspicious URLs suggests an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-card-collection-hack-apk-game-hack PDF link annotation
    • http://lib.uho.ac.id/library/repository/coin-master-free-spins-link-fb_GM406889139.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/minecraft-hacks-ps4_GM479516143.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/hack-roblox-plusieur-onglet_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/minecraft-menu_GM479516143.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/coin-master-hacks_GM406889139.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/spin-free-coin-master_GM406889139.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/static-moonactive-net-rewards_GM406889139.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/how-many-levels-does-coin-master-have_GM406889139.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/free-robux-without-a-human-verification_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/lazyblox-com-free-robux_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/mobihack-roblox-hack_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/free-spin-coin_GM406889139.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/robloxheroxyz-free-robux_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/pubg-uc-and-bp-generator_GM1330123889.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/free-spins-coin-master-links-blogspot_GM406889139.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/free-robux-rewards_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/how-to-get-a-free-private-roblox_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/free-robux-no-human-verification-generator_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library/repository/free-robux-with-no-human-verification_GM431946152.pdfIn PDF document text
    • http://lib.uho.ac.id/library//repository/coin-master-free-spins-link-today_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000325d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x325D 22856 bytes
SHA-256: a61b00e6ecd948ecfec5e28a427ba28eb13bf3d13432ae9eaedc6a6b77c67dec
font_01_sfnt_off00006572.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6572 18428 bytes
SHA-256: fbaa9a7aa99ed65dc179949451f9d180593252eeb381fe8625a198a51d214ab5

Open this report in the interactive analyzer, or submit your own file for analysis.