PDF static analysis report

Static analysis result for SHA-256 33aceb79baca5570…

SUSPICIOUS

PDF

39.5 KB Created: 2021-05-21 18:17:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6ae7dda026cfe8f2bbc74b9daadc2b7f SHA-1: ac275d2e4b60f9c9c8886c49052b353c4f76b9a1 SHA-256: 33aceb79baca55702ce6a71f2df2351ca01fe994f79ced86982e2207af58bcd3
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains multiple embedded URLs and a visual download button lure, suggesting an attempt to trick the user into downloading a payload. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the document's content pointing to 'free Minecraft printables' and 'game hack' indicate a social engineering tactic to facilitate a download. The primary malicious URL identified is https://netcdn.xyz/app/479516143/free-minecraft-printables-food-labels-game-hack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8060

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/free-minecraft-printables-food-labels-game-hack PDF link annotation
    • https://www.shin.ge/images/free-robux-hack-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
    • https://www.shin.ge/images/freespinandcoinblogspotcom-2021-11-coinmasterfreespinandcoinlinkshtml_GM406889139.pdfIn PDF document text
    • https://www.shin.ge/images/free-robux-no-verify-2021_GM431946152.pdfIn PDF document text
    • https://www.shin.ge/images/coin-master-homepage_GM406889139.pdfIn PDF document text
    • https://www.shin.ge/images/hacks-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003670.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3670 24528 bytes
SHA-256: 2aa084f8d00e24af380c83ded088c392231c452227e7b48987a442b2354212ce
font_01_sfnt_off00006e56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E56 3240 bytes
SHA-256: 1a21520873bfcc3e3392b1906bd8bfba8e6be354e70f9858e4fcee958289e004
font_02_sfnt_off00007905.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7905 18272 bytes
SHA-256: f2c529c176ea6290bd871c2fd1a1a72e1d93e196016b8d790adf98aeb938da6a

Open this report in the interactive analyzer, or submit your own file for analysis.