PDF static analysis report

Static analysis result for SHA-256 12ba2e9b3bb32cf9…

SUSPICIOUS

PDF

35.3 KB Created: 2021-07-06 11:14:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6a726193100b9fc559b79c86c04aa16d SHA-1: 5359496987bc4df451bd76ddacaaff2e96fde57a SHA-256: 12ba2e9b3bb32cf9ac97f6fe6c4b103e2293338055a6026c17305f339eb7e4d3
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a lure related to game cheats and in-game currency, with an embedded URI pointing to a suspicious domain. The ML classifier strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of external URIs and the document's content suggest it is designed to redirect users to potentially harmful websites for downloads or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/how-to-hack-m-coins-mcpe-master-game-hack PDF link annotation
    • https://pt-mataram.go.id/perpustakaan/repository/inappropriate-roblox_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/free-spins-on-coin-master-iphone_GM406889139.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/roblox-bloxburg-tips-and-cheats_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/how-to-hack-roblox-peoples-accounts_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/free-account-roblox-with-robux_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/how-do-you-hack-free-robux-2021-on-pc_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/how-to-get-free-robux-on-computer_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/tiktok-followers-for-free_GM835599320.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/how-to-make-a-group-on-roblox-for-free_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/roblox-gang_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/free-apk-mods-coin-master_GM406889139.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/coin-master-official-page_GM406889139.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/free-accessories-roblox_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/how-to-get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/free-minecraft-java-edition-codes_GM479516143.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/roblox-robux-codes-free-2021_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/how-to-get-free-coins-in-coin-master_GM406889139.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/roblox-free-online-game_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/free-download-roblox-game-for-pc_GM431946152.pdfIn PDF document text
    • https://pt-mataram.go.id/perpustakaan/repository/roblox-hack-com-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000032df.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32DF 23152 bytes
SHA-256: 73846d4bd4657e355f775a8315eccb14e5dabff6bba8ff5ee17ff51647d6b6d3
font_01_sfnt_off00006727.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6727 18344 bytes
SHA-256: ab5992d8208103665e88bb87f17abe6e5121c78e3422836785a640f915820765

Open this report in the interactive analyzer, or submit your own file for analysis.