PDF static analysis report

Static analysis result for SHA-256 26f8edb49d1180ab…

SUSPICIOUS

PDF

45.0 KB Created: 2021-06-08 00:06:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 0bc2a0f1bee0fad1de709c4b236c57d6 SHA-1: 896afe177ac45afdb592adc0be93c5e11a10c9e8 SHA-256: 26f8edb49d1180ab1da8fd494bb7d3ce71f36b76b97f4d475ba3e9af499f6acc
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a visual download button lure, strongly suggesting an attempt to trick users into downloading malicious files. The ML classifier also flagged this PDF with high confidence. The primary URL points to game cheats, a common lure for malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-dungeon-quest-cheats-game-hack PDF link annotation
    • http://ines.co.rs/images/free-roblox-accounts-with-robux_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/how-to-get-free-robux-using-hdmi_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/rewardrobux-com_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/100-free-spins-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://ines.co.rs/images/coin-master-2021-free-spins-link-2021_GM406889139.pdfIn PDF document text
    • http://ines.co.rs/images/free-coins-coin-master_GM406889139.pdfIn PDF document text
    • http://ines.co.rs/images/minecraft-bedrock-client_GM479516143.pdfIn PDF document text
    • http://ines.co.rs/images/real-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://ines.co.rs/images/is-there-a-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/how-do-i-get-free-coins-in-coin-master_GM406889139.pdfIn PDF document text
    • http://ines.co.rs/images/is-minecraft-free-on-nintendo-switch_GM479516143.pdfIn PDF document text
    • http://ines.co.rs/images/coin-master-links-for-today_GM406889139.pdfIn PDF document text
    • http://ines.co.rs/images/minecraft-hacked-client-download_GM479516143.pdfIn PDF document text
    • http://ines.co.rs/images/how-to-make-a-group-on-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/no-human-verification_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/how-to-make-free-robux_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/coin-master-claim-spins_GM406889139.pdfIn PDF document text
    • http://ines.co.rs/images/roblox-hack-unlimited-robux_GM431946152.pdfIn PDF document text
    • http://ines.co.rs/images/coin-master-free-spins-ios-app_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000514c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x514C 25316 bytes
SHA-256: f1a8fa9a644241d5d1414eb0c69f7dd8e83c3cad8a730346e0ac8cc14ee22557
font_01_sfnt_off00008ad4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8AD4 19036 bytes
SHA-256: e037b934e72c4bd4d62708f745a7c5cd3660817fced6bcc550343e1d642cbacc

Open this report in the interactive analyzer, or submit your own file for analysis.