PDF static analysis report

Static analysis result for SHA-256 5c0aa89ddf48d268…

SUSPICIOUS

PDF

34.7 KB Created: 2021-07-05 06:09:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 147973505a92ba958b64e4dd355921a4 SHA-1: 7ab75232273df947559a66e977fa577454b88cd2 SHA-256: 5c0aa89ddf48d2681d5dc5e7167f2f22549800d78067807019f65a7d21471147
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs, including one pointing to 'netcdn.tw', which are likely intended to direct users to download malicious files. The document body and extracted URLs suggest a lure related to game cheats and in-game currency, a common social engineering tactic. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/where-to-get-robux-game-hack PDF link annotation
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/exploits-for-roblox-cheats_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/robux-generator-2021-free_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/how-to-get-roblox-packages-for-free_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/como-sacar-buen-puntaje-en-juego-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/roblox-fallen-hacks_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/pokemon-go-free-install_GM1094591345.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/roblox-report-hacker_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/coin-master-server-hack_GM406889139.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/boku-no-roblox-hack_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/hacks-on-roblox-for-robux_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/how-to-get-free-face-roblox_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/how-to-free-robux-no-hack_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/roblox-free-download-for-macbook-air_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/hack-coin-master-apk-ios_GM406889139.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/conseguir-robux-gratis-hack_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/free-likes-on-tiktok_GM835599320.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/free-spin-hack-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/how-to-get-free-tiktok-likes_GM835599320.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://study.mtsn3limapuluhkota.sch.id/__statics/gudangsoal/files/how-to-hack-peoples-roblox-accounts_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31FD 21976 bytes
SHA-256: d6b850e4d3b508df2ad0b5132f2f39df62a26edee30bf3be7fc5ceff9e733169
font_01_sfnt_off0000628c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x628C 19020 bytes
SHA-256: 6b187cd57cde92260f16f12b95c296276b7f1be274984c71898e0c4379279113

Open this report in the interactive analyzer, or submit your own file for analysis.