PDF static analysis report

Static analysis result for SHA-256 56841e9e1c119a99…

SUSPICIOUS

PDF

42.7 KB Created: 2021-05-12 00:09:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 5ea82316670b65ea8419318871ee46d8 SHA-1: 1096be00a9a5189d77dae47d6c87968aa05c47ef SHA-256: 56841e9e1c119a992fc62989c4bd03a0d398062e08f483197bdf7a75a0e2c0c0
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The ML classifier strongly indicates maliciousness, and the document body contains text and URLs related to hacking games like Coin Master and Roblox. The presence of external URIs suggests the document is designed to redirect users to download potentially malicious files, likely as part of a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/hackear-juego-coin-master-game-hack PDF link annotation
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/free-group-roblox_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/roblox-com-hack_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/coin-master-reward-link_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/coin-master-game-hack_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/minecraft-noob-vs-pro-vs-hacker_GM479516143.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/play-full-version-of-minecraft-for-free-no-download_GM479516143.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/how-to-download-minecraft-for-free-on-windows-10_GM479516143.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/games-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/freespins-coin-master_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/coin-master-free-spins-5-10-2021_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/easy-robux-com_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/coin-master-free-spins-link-download-free_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/download-coin-master-hack-apk_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/free-coin-and-spin-link_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/apps-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/roblox-help-free-robux_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/free-daily-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/free-robux-survey_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/hacking-apps-for-roblox_GM431946152.pdfIn PDF document text
    • https://zephyrtoys.com/assets/ckfinder/userfiles/files/how-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004c84.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4C84 24828 bytes
SHA-256: b6631a2672da10eb79c9c3cecb3156b20245db2a9e703f4f357fbc53dd863030
font_01_sfnt_off0000848f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x848F 18308 bytes
SHA-256: 85adf4a15c24233f1c93bca6a3c18238941d111dac195f6ddf82d6394f744ad0

Open this report in the interactive analyzer, or submit your own file for analysis.