PDF static analysis report

Static analysis result for SHA-256 01eea1255809893d…

SUSPICIOUS

PDF

34.5 KB Created: 2021-07-04 05:39:08 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: e63cf7317dfcf49dc17bac3b58d76ccf SHA-1: 12534c96298c1162c45fb9b51a45ce53de69f277 SHA-256: 01eea1255809893d418cd2c502fafc0f313116b333f934b8f12a23c290de433a
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a URL and a heuristic firing for an external URI, both pointing to a download for a 'hacked client'. The presence of a 'download button' heuristic further supports the lure. The ML classifier also flagged this PDF as malicious with high confidence. The document body confirms the lure by mentioning 'Minecraft 112 Hacked Client' and embedding the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/minecraft-112-hacked-client-game-hack PDF link annotation
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/free-roblox-clothes-app_GM431946152.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/alt-delete-item-roblox-hack_GM431946152.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/roblox-how-to-get-free-obc-2021_GM431946152.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/minecraft-pe-hacks-ios_GM479516143.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-hack-pc-free_GM406889139.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/hack-para-roblox-robux_GM431946152.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/crear-hack-de-robux_GM431946152.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-free-spins-link-whatsapp-group_GM406889139.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/play-minecraft-for-free_GM479516143.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/comment-hacker-roblox-macbook-pro_GM431946152.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/how-to-hack-into-somebodys-roblox-account_GM431946152.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-zephplayz_GM431946152.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/roblox-font-free_GM431946152.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/how-to-make-a-roblox-group-for-free_GM431946152.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/how-to-get-pants-not-by-roblox-free_GM431946152.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/robux-hack-no-verification-survey_GM431946152.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/free-roebucks_GM431946152.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-free-daily-spins-and-coins_GM406889139.pdfIn PDF document text
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-hack-unlimited-spins-apk_GM406889139.pdfIn PDF document text
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/ios-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003376.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3376 21896 bytes
SHA-256: ce6d3b58a32e13ddf4e9743738c4067321d5a4fb316d1a1916756ff6a51a504b
font_01_sfnt_off000063b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63B9 18504 bytes
SHA-256: 1c6239c4e7240bb93b61e959f2b21d4e00e02324577494d7f11381c67a244304

Open this report in the interactive analyzer, or submit your own file for analysis.