PDF static analysis report

Static analysis result for SHA-256 4e9d89a11aa0cbf9…

SUSPICIOUS

PDF

33.8 KB Created: 2021-07-01 13:09:22 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: b1009f94e80b654a1860ed756412f030 SHA-1: a39222e7090b46881f9c3c2330dd8540fff87a29 SHA-256: 4e9d89a11aa0cbf97ab01c6db5ad401310f8fe30b7719c4a3fdeca001b562345
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a prominent external URI pointing to sites offering game cheats and hacks. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of it being used to distribute malware or lead users to malicious websites. The presence of these links suggests an attempt to trick users into downloading further malicious content or visiting compromised sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-car-dealership-tycoon-cheats-game-hack PDF link annotation
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/i-want-robux_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/real-robux-generator-2021_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/free-minecraft-mods-for-ps4_GM479516143.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/how-do-i-get-robux_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/is-minecraft-free-on-ps4_GM479516143.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/oprewards-points-generator_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/robuxian-robux-hack-2021_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/coin-master-free-spins-reddit_GM406889139.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/codes-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/free-minecraft-maps-pe_GM479516143.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/coin-master-hack-online-download_GM406889139.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/hackear-coin-master-sin-root_GM406889139.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/hack-coin-master-spin-apk_GM406889139.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/robux-com-free_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/oprewards-com-login_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/minecraft-java-free-account_GM479516143.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/cute-free-stuff-on-roblox_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/cuantas-hackeadas-de-roblox_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/how-to-hack-in-roblox-easy_GM431946152.pdfIn PDF document text
    • https://elearningman1kotacirebon.sch.id/__statics/gudangsoal/files/free-gift-card-generator-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ffa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FFA 21124 bytes
SHA-256: eaa47f8d2ade89aa0d1562b743c9a803b445efb5d52d8b0af626550822ff7037
font_01_sfnt_off00005e03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E03 19400 bytes
SHA-256: 2adcd57832573ed5e6749b25ab0076e6beb9c753e68282d44464dd6e5b8ce290

Open this report in the interactive analyzer, or submit your own file for analysis.