PDF static analysis report

Static analysis result for SHA-256 282c1b86e8e14003…

SUSPICIOUS

PDF

43.2 KB Created: 2021-05-10 19:03:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 9172204c786b15dbf6dd201a9d6e65b3 SHA-1: c187c0f4b437284907c015be96ad6fa1803bce5e SHA-256: 282c1b86e8e1400309f2b731bb537725e2e7623e031974c5fa574b7269c26eb1
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a lure related to free game items, strongly suggesting a phishing or scam campaign. The ML classifier also flagged this PDF with high confidence. While no scripts were explicitly extracted, the presence of embedded URLs and the document's theme indicate an attempt to trick the user into downloading potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/best-free-minecraft-skins-game-hack PDF link annotation
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/hack-xp-net-generators-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-get-free-robux-on-phone-2021_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/is-minecraft-bedrock-free_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-games-that-actually-work-2021_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coun-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/complete-offers-for-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-no-anti-bot-verification_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/cheats-to-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/best-free-spin-app-for-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-minecraft-maps-pe_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/is-roblox-free-on-ps4_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-obby_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-scams_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-mod-apk-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/minecraft-cheats-switch_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/rbxfree-com-free-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-heaven-free-spins-today_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-admin-roblox_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/minecraft-games-online-free-no-download_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-hack-roblox-on-mobile_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F29 25064 bytes
SHA-256: 7b7222ee3d6301793d51250d6e6ca3d66e0a61f0a66bd34e84157e90951c7cb8
font_01_sfnt_off000087b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x87B5 17952 bytes
SHA-256: 90e1a77296b834dd3535238b68d8e828a30bfd58102e774479de80706a00ebac

Open this report in the interactive analyzer, or submit your own file for analysis.