PDF static analysis report

Static analysis result for SHA-256 0e17d66d8333942a…

SUSPICIOUS

PDF

42.1 KB Created: 2021-05-14 13:30:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 7c9b56450e565c0a5d98d7dcdc9880f9 SHA-1: c5337361ff02b25b9f78520026044a8f5fe50089 SHA-256: 0e17d66d8333942af503382c2e28a8f22ebdf40c6af4166c4c5903f266530b29
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded URLs and a visual download button lure, suggesting an attempt to trick the user into downloading a secondary payload. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple URLs related to game hacks reinforces the phishing pretext. No scripts were extracted, limiting further analysis of execution behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/optifine-pe-game-hack PDF link annotation
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/daily-free-spins-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-coin-master-spins-hack_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/bux-free-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-generator-2021_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-hackhub-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/pasos-para-hackear-coins-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-lovenet_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-unlimited-coin-master-400-spin-link_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/hack-version-of-coin-master-apk-download_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-instantly_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-spins-coin-master-march-2021_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-coin-master-gifts_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-much-robux-can-you-get-with-1-million-dollars_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-free-spins-and-cards_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-group-free-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-codes-2021-not-used_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-spin-coin-master-instagram_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/minecraft-xbox-360-free_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-daily-free-spins-and-coins-2021_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/minecraft-launcher-download-free_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004cdf.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4CDF 24588 bytes
SHA-256: 5b82541b7490100ff22bc1489c838d8921bdafcb19a646ab286bab21e3e5f5ce
font_01_sfnt_off00008431.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8431 17672 bytes
SHA-256: 5a469ca17a8c140357c1150986cbf8b325a348879e3a8ed2f5f73ca7af5c2fd6

Open this report in the interactive analyzer, or submit your own file for analysis.