PDF static analysis report

Static analysis result for SHA-256 09027acf332e644c…

SUSPICIOUS

PDF

41.0 KB Created: 2021-05-23 01:09:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a01d2b45b453454974c88fcef1ec39dc SHA-1: 179a2a8df3334605d47b66d0bd600d195cb2f123 SHA-256: 09027acf332e644cf17b063f43a9b1f2882bed5253d59d2db833c2aef78a2702
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a visual download button lure, aiming to trick the user into clicking a link for "Coin Master Free Spins". The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of external URIs and the overall structure suggest a phishing or scam attempt, likely leading to a malicious download or redirect.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7508

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-free-spins-link-today-new-2021-game-hack PDF link annotation
    • https://elearning.mtsn1tasikmalaya.sch.id/__statics/gudangsoal/files/daily-free-spins-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn1tasikmalaya.sch.id/__statics/gudangsoal/files/free-robux-generator-no-human-verification-or-survey-2021_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1tasikmalaya.sch.id/__statics/gudangsoal/files/minecraft-windows-10-free-code_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn1tasikmalaya.sch.id/__statics/gudangsoal/files/coin-master-daily-free-spins-blogspot_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn1tasikmalaya.sch.id/__statics/gudangsoal/files/roblox-com-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000381f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x381F 25704 bytes
SHA-256: bc14a6fcc096c3e8b690f7ef5793e75655e1ac0d71133806215685495361ba29
font_01_sfnt_off0000729d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x729D 2940 bytes
SHA-256: 709bf95dbf65b0df8befcda2531d8b15ff768d9fedb280bcb80e491eb7260bb6
font_02_sfnt_off00007caf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7CAF 18976 bytes
SHA-256: 9ab4b87832590d82aec569b9c8693c2016d5d9151569e528de1ed13ad8a1cb2c

Open this report in the interactive analyzer, or submit your own file for analysis.