PDF static analysis report

Static analysis result for SHA-256 4037db3069e2c392…

SUSPICIOUS

PDF

43.7 KB Created: 2021-05-10 10:39:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a586e4debb3666c8da64b9c7d23d5037 SHA-1: dd5f9501e206b5d2b2d8142ce877e240b2da2b70 SHA-256: 4037db3069e2c392a0726122d54c9d6d1e765b5f2147111acb49ba47c250d48a
52 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a lure for a visual download button and explicitly instructs the user to copy and paste content into a shell context, likely to execute a downloaded payload. The embedded URL points to a suspicious domain often associated with malware distribution.

Machine Learning

  • Nyx PDF Classifier clean score 0.0119

Heuristics 4

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/optifine-pe-game-hack PDF link annotation
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000036f7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x36F7 28980 bytes
SHA-256: be77cb0c368a68eb25feeec1e5f363508296bb7d067ae0d54b6b50824c193f6b
font_01_sfnt_off000076c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76C4 3020 bytes
SHA-256: f1a29adcea636583330be8db4f6466410de551ac48576b9e1aa5c34e2d665a1f
font_02_sfnt_off00008119.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8119 2816 bytes
SHA-256: 4555740682277f0055d57b15bd0ba953e5b51415ea3d21c93db391eace072d4f
font_03_sfnt_off00008b2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8B2A 17672 bytes
SHA-256: 5a469ca17a8c140357c1150986cbf8b325a348879e3a8ed2f5f73ca7af5c2fd6

Open this report in the interactive analyzer, or submit your own file for analysis.