PDF static analysis report

Static analysis result for SHA-256 05ae7a68198f417a…

SUSPICIOUS

PDF

34.9 KB Created: 2021-07-03 10:15:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: e94eb05e37afb1e7787cf56af283119c SHA-1: c0e74aae15d6cdcaaaece54446ee3eb23e5fd265 SHA-256: 05ae7a68198f417a40658fa4b0a2f7e0bcc11226168e08b8b20a15ffc2a2a09b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains embedded URLs and a document body that explicitly promises game hacks and cheats, indicating a lure for users to download malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the suspicious nature of the embedded links. The presence of multiple URLs pointing to similar content suggests a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/406889139/pasos-para-hackear-coins-master-game-hack PDF link annotation
    • http://baxtton.com/sites/default/files/files/free-robux-no-human-verification-no-survey_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/no-scam-free-robux_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/coin-master-free-spins-apple_GM406889139.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/hack-to-send-gold-cards-on-coin-master_GM406889139.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/free-robux-generator_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/free-robux-codes-generator_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/crouption-roblox-hack_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/free-robux-group_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/como-instalar-hacks-roblox_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/robux-without-verification_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/roblox-free-executor_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/how-to-hack-a-roblox-account-easy_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/roblox-what-do-you-do-when-your-account-gets-hacked_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/how-to-earn-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/daily-coin-master-free_GM406889139.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/how-to-use-cheat-engine-67-on-roblox-2021_GM431946152.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/free-links-for-free-coins-and-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/minecraft-apk-114-4_GM479516143.pdfIn PDF document text
    • http://baxtton.com/sites/default/files/files/coin-master-online_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000339c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x339C 22600 bytes
SHA-256: d363cdbc73e05d4f385be617edeefea09b354c982af0d6017d07af7b643f8bc7
font_01_sfnt_off00006611.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6611 18160 bytes
SHA-256: 8de320d26ad23d14df74f7a15048384cdc3d2e03834f709f531179936ba98ebc