PDF static analysis report

Static analysis result for SHA-256 053a9b5ae9dfdd4a…

SUSPICIOUS

PDF

33.7 KB Created: 2021-07-05 10:14:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a78502a90b513e50940562e338aeebb4 SHA-1: e9e330ccf341e2dd3b3a5f9ee94a6c009d7b11b9 SHA-256: 053a9b5ae9dfdd4a8ff7f00c4402d6370cec71cf42e131b199a74a8403cf7d27
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains numerous embedded URLs and a prominent external URI pointing to sites offering game hacks and free in-game currency, indicating a lure for potentially malicious downloads. The ML classifier strongly flagged this PDF as malicious, supporting the suspicious nature of the content. While no scripts were extracted, the presence of multiple suspicious URLs suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/how-to-hack-in-arsenal-game-hack PDF link annotation
    • http://muslib.unmus.ac.id/repository/blockland-roblox-free-robux_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id//repository/coin-master-hack-injection_GM406889139.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/roblox-games-to-troll-with-hacks_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/roblox-with-commands-hack_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/how-to-get-free-robux-on-roblox-on-ipod_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id//repository/coin-master-free-spins-link-2021-today_GM406889139.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/all-free-account-roblox-obc_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/free-roblox-gamepasses-app_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id//repository/coin-master-free-spins-no-verification_GM406889139.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/codes-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/citizen-roblox-hack_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/cool-free-roblox-hats_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id//repository/robux-earning-websites_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/free-robux-no-downloading-apps_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/game-hack-36-roblox_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/how-to-get-1-million-free-robux-breast-milk_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/mcpe-master-hack-unlimited-coins_GM406889139.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/how-to-put-in-hack-on-any-roblox-game_GM431946152.pdfIn PDF document text
    • http://muslib.unmus.ac.id/repository/roblox-commands-hack_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F00 22308 bytes
SHA-256: 2d2350a1c55f32461ae00f907f1d7b4a781da1b87e3964bb5f299fd6a195af4a
font_01_sfnt_off0000605b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x605B 18452 bytes
SHA-256: e830d4d2850352ff681c802b50bfdb69e36cdf0dd9a2fca6f972fc848603048f

Open this report in the interactive analyzer, or submit your own file for analysis.