PDF static analysis report

Static analysis result for SHA-256 24efeb90257f0ce8…

SUSPICIOUS

PDF

43.2 KB Created: 2021-05-16 15:04:51 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: dd86f75b5462d119e50eff675be95c6b SHA-1: 1ae1a1a2c6452b6ee6ba1423ef11d7fa6a9b0d1d SHA-256: 24efeb90257f0ce86bcea9fe8f9b72eeb84281bd7a857a416e3dd80bfeb645d7
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains an embedded URI and multiple other URLs that are likely intended to lead the user to download malicious content, disguised as game-related downloads. The ML classifier strongly indicated maliciousness, and the presence of a visual download button heuristic further supports a social engineering lure. No scripts were extracted, limiting the analysis of direct execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-games-to-play-for-free-game-hack PDF link annotation
    • https://mawaridschools.com/uploaded_files/userfiles/files/coin-master-free-snacks-link_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/minecraft-pocket-edition-mods-for-free_GM479516143.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/free-robux-just-enter-username_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/free-coin-master-spin-generator_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/how-to-earn-robux-fast_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/coin-master-card-collection-hack-2021_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/get-free-robux-com_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/how-to-get-free-roblox-premium_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/how-to-get-free-minecoins-in-minecraft_GM479516143.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/how-to-get-free-robux-games_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/do-you-get-windows-10-minecraft-for-free-with-java_GM479516143.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/coin-master-free-spins-and-coins-generator_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/flame-gg-free-robux_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/coin-master-free-spins-and-coins-link-haktuts_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/free-spins-coin-master-links-blogger_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/how-to-hack-coin-master-apkmody_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/free-robux-hack-2021_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/free-coins-coin-master_GM406889139.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/free-robux-hack-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
    • https://mawaridschools.com/uploaded_files/userfiles/files/coin-master-ios-hack-download_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004e0e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E0E 24948 bytes
SHA-256: 2aa9a3161971dcce3eb53b5ef0a8d64170c0e46dbf766c6e57f502ab6b74a2df
font_01_sfnt_off00008673.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8673 18380 bytes
SHA-256: e4e6021f190597b5ba2cc648d82e873dd3d7a425745f666e69b81b8efe23a832

Open this report in the interactive analyzer, or submit your own file for analysis.