PDF static analysis report

Static analysis result for SHA-256 17e32bae506746cd…

SUSPICIOUS

PDF

38.4 KB Created: 2021-05-20 13:02:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4a29f81bfa309bb2dae59334e04a5a22 SHA-1: 6690285bc0103d8419a7d2ccdaeb2f7de209ecb7 SHA-256: 17e32bae506746cd493e3ed02eb8aae4db5ffd12c7b1a8a7de00802205c0e98a
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a call-to-action button, suggesting a phishing or scam attempt. The ML classifier also flagged the document as malicious. The document body explicitly mentions 'How To Get Tiktok Likes For Free' and 'CLICK HERE TO ACCESS TIKTOK GENERATOR', reinforcing the lure. While no scripts were directly extracted, the presence of external URIs and the overall context indicate a likely attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7268

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/835599320/how-to-get-tiktok-likes-for-free-game-hack PDF link annotation
    • http://elibraryfk.unjani.ac.id/fkrepository/repository/tiktok-free-download-video_GM835599320.pdfIn PDF document text
    • http://elibraryfk.unjani.ac.id/elibrary/repository/free-robux-no-verification-no-download_GM431946152.pdfIn PDF document text
    • http://elibraryfk.unjani.ac.id/fkrepository/repository/coin-master-free-cards-link_GM406889139.pdfIn PDF document text
    • http://elibraryfk.unjani.ac.id/fkrepository/repository/how-to-hack-m-coins-mcpe-master_GM406889139.pdfIn PDF document text
    • http://elibraryfk.unjani.ac.id/fkrepository/repository/8bp-hack-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000300c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x300C 25952 bytes
SHA-256: 95268ba3cb4cfbae92eda35f7e42becc29f72d3956597cec291e01c8a692d90e
font_01_sfnt_off00006ba1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BA1 3124 bytes
SHA-256: d6dd29adb69da7f9a23a5e3791282a61e2f811794f560a0c409c8747766d9102
font_02_sfnt_off0000765b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x765B 17620 bytes
SHA-256: 8696ad91bcc449f479e4da9fb9fcd1bc9622318b4b4e0c286d8bf8cc17ae5eac

Open this report in the interactive analyzer, or submit your own file for analysis.