PDF static analysis report

Static analysis result for SHA-256 3bc68ecff7c6edc2…

SUSPICIOUS

PDF

46.4 KB Created: 2021-06-07 17:48:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 36527351a2538f9fcd0afd6cd65ac159 SHA-1: 0b1cf8ea3cb5564a428164e76ef190fac41aacb6 SHA-256: 3bc68ecff7c6edc2024c15e001a0a443047b21705031fbab3bab7970375ebbf5
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains numerous embedded URLs and a visual call-to-action, strongly suggesting it is designed to trick users into downloading further malicious content. The ML classifier also flagged this PDF as malicious with high confidence. The document body, though heavily garbled, contains references to game hacks and a URL that aligns with this malicious lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9832

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-project-pokemon-dll-hack-game-hack PDF link annotation
    • http://innovativefs.co.uk/images/coin-master-hack-pro_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/roblox-robux-codes-2021_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/free-robux-generator-no-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/cheat-engine-speed-hack-roblox-2021_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/free-robux-no-verification-no-download_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/coinmaster-spins_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/robux-money_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/hacks-for-coin-master-game_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/coin-master-free-spin-and-coin-links_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/coin-master-hack-apk-april-12-2021_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/robux-hack-me_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/free-robux-no-survey_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/how-to-get-free-coins-on-coin-master-iphone_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/hacker-list-roblox_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/daily-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/free-coin-and-spin-for-coin-master_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/coin-master-daily-free-spins-link-blogspot_GM406889139.pdfIn PDF document text
    • http://innovativefs.co.uk/images/tiktok-free-view-iphone-apk_GM835599320.pdfIn PDF document text
    • http://innovativefs.co.uk/images/how-to-get-free-robux-codes-2021_GM431946152.pdfIn PDF document text
    • http://innovativefs.co.uk/images/http-bitly-coin-master-free-2021-spins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000540b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x540B 26280 bytes
SHA-256: 4dcfcd35a954e22d510e22aaf5ccf65dbfeb7d14ee822ab0ec77bb7337cbdc04
font_01_sfnt_off000090a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x90A9 19056 bytes
SHA-256: 6e13fa7c69c33c18eb7bb26b69c65bf0d8600c1c57b2e873d85f69b1b03bf4ab

Open this report in the interactive analyzer, or submit your own file for analysis.