PDF static analysis report

Static analysis result for SHA-256 28dfe3f65f311b7c…

SUSPICIOUS

PDF

40.4 KB Created: 2021-05-16 11:07:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 70ce5273be42cbd10083edb18959c79d SHA-1: 5145cfc5caf1c8c43316a359a732d9560cca92a7 SHA-256: 28dfe3f65f311b7c297e307df8b990492bbe472d44b5fd7fdca55694e7508b82
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URI pointing to a suspicious domain, and a machine learning classifier flagged it as malicious. The document body text and heuristics suggest a lure related to game cheats or rewards, likely intended to trick the user into clicking the link. While no scripts were explicitly extracted, the presence of embedded URLs and the ML detection indicate a high probability of malicious intent, possibly involving a download or redirection to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/oprewards-com-login-game-hack PDF link annotation
    • https://rincondelentrenador.com/images/como-hackear-coin-master-espaol_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/roblox-font-free_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/coin-master-golden-cards-hack_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/how-to-get-free-spins-on-coin-master-without-waiting_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/freespinandcoin_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/best-site-for-free-coin-master_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/robux-online_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/how-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-roblox-toy-codes-2021_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/hack-coin-master-using-pc_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-robux-games-that-actually-work_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-coin-master-spins-2021_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-coins-coin-master-spins_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-minecraft-videos_GM479516143.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-spin-coin_GM406889139.pdfIn PDF document text
    • https://rincondelentrenador.com/images/how-to-hack-in-arsenal_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/inappropriate-roblox_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-minecraft-account-and-password-2021_GM479516143.pdfIn PDF document text
    • https://rincondelentrenador.com/images/hacks-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://rincondelentrenador.com/images/roblox-adopt-me-hack_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004441.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4441 23648 bytes
SHA-256: b0fbad6f7ddbbc3f0df586ae05d30dc82910c23b8642f40f1de4a1f3e819cd7d
font_01_sfnt_off000079b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79B7 18752 bytes
SHA-256: c42b4bb1fbee134c465cf242b0910ab071fad09d05a92a897e82c1c678a63515