PDF static analysis report

Static analysis result for SHA-256 30c46c932e0c8ce2…

SUSPICIOUS

PDF

46.8 KB Created: 2021-06-08 17:50:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: b561909cc6999f3d5823d5b2bb7d53fe SHA-1: 0be5aba0d8413332cd7c756023e48ab2a5763000 SHA-256: 30c46c932e0c8ce21242b65ce7958442f942af6d25d82c3b51c8928f4a365dde
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a visual download button lure, suggesting an attempt to redirect users to malicious sites. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous links related to game hacks and free accounts indicates a phishing or malware distribution attempt. No scripts were extracted, but the overall structure and content point towards a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9832

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-roblox-account-site-youtube.com-game-hack PDF link annotation
    • http://doganov.be/images/minecraft-hacks-xbox_GM479516143.pdfIn PDF document text
    • http://doganov.be/images/100-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://doganov.be/images/free-tiktok-accounts-and-passwords_GM835599320.pdfIn PDF document text
    • http://doganov.be/images/how-to-get-free-minecraft-skins_GM479516143.pdfIn PDF document text
    • http://doganov.be/images/get-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://doganov.be/images/spinuri-gratis-coin-master_GM406889139.pdfIn PDF document text
    • http://doganov.be/images/coin-master-hack-ios-download_GM406889139.pdfIn PDF document text
    • http://doganov.be/images/get-free-coins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://doganov.be/images/free-roblox-shirt-templates-2021_GM431946152.pdfIn PDF document text
    • http://doganov.be/images/is-minecraft-free-on-xbox_GM479516143.pdfIn PDF document text
    • http://doganov.be/images/coin-master-free-gifts_GM406889139.pdfIn PDF document text
    • http://doganov.be/images/free-minecraft-client_GM479516143.pdfIn PDF document text
    • http://doganov.be/images/free-promo-codes-for-robux_GM431946152.pdfIn PDF document text
    • http://doganov.be/images/all-links-for-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://doganov.be/images/free-robux-sites-2021_GM431946152.pdfIn PDF document text
    • http://doganov.be/images/minecraft-free-ios-2021_GM479516143.pdfIn PDF document text
    • http://doganov.be/images/free-robux-exe_GM431946152.pdfIn PDF document text
    • http://doganov.be/images/give-me-robux_GM431946152.pdfIn PDF document text
    • http://doganov.be/images/get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • http://doganov.be/images/free-robux-generator-com-roblox-hack_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004f94.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4F94 29308 bytes
SHA-256: 44405de7c1010082459f4d9d4169d42d0b4b3fbdb4d2bdac4143c24889080428
font_01_sfnt_off000092f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92F8 18800 bytes
SHA-256: f1cc215f96561998deaee5da0cd982550d646bd4263e9c3394b530b56e640362

Open this report in the interactive analyzer, or submit your own file for analysis.