PDF static analysis report

Static analysis result for SHA-256 4854ab537100a2a8…

SUSPICIOUS

PDF

43.7 KB Created: 2021-05-13 21:07:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4284abc3c585f1faa1d22033faeff072 SHA-1: 401e503c7dc51059d611a726a10144f92028124c SHA-256: 4854ab537100a2a869df95ffc82ed91e4367c4d6ffe601d70ddc54037ebcf351
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs, with a primary one pointing to a 'Coin Master Heaven Free Spins And Coins' lure. The ML classifier strongly flagged this PDF as malicious. The presence of these links suggests the document is designed to redirect users to potentially malicious websites, likely for phishing or to download further malware. No scripts were extracted, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-heaven-free-spins-and-coins-game-hack PDF link annotation
    • http://moto98.com/images/free-100-robux_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/coin-master-card-link-free_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/free-spins-coins-coin-master_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/coin-master-spin-hack-trick_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/free-coins-for-planet-master-game_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/free-spins-on-coin-master-generator_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/how-to-hack-minecraft-pe_GM479516143.pdfIn PDF document text
    • http://moto98.com/images/clean-master-hack-coins_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/coin-master-3rd-village-free-2021-gift-card_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/hack-coin-master-with-lucky-patcher_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/rbxcity-free-robux_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/free-coin-master-spins-without-human-verification_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/orewards-com-free-robux_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/reddit-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/coin-master-free-gifts_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/how-to-get-free-robux-fast_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/how-to-get-free-robux-without-doing-anything-2021_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/how-to-get-free-robux-codes_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/coin-master-hack-app-download-free_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/coin-master-free-coins-link-2021-today_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004810.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4810 29792 bytes
SHA-256: d504298984c82adfdb1f4137e84a348faa1b4075f1107251a8e007c10dcd1628
font_01_sfnt_off00008907.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8907 18172 bytes
SHA-256: bdd24314abe2f3b39aecf21834c7cd26032852c94e6fb36ef69e936b1b82ae40

Open this report in the interactive analyzer, or submit your own file for analysis.