PDF static analysis report

Static analysis result for SHA-256 5c441c6c114e2ea2…

SUSPICIOUS

PDF

41.2 KB Created: 2021-05-19 04:30:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 2eb69cd8abea9589c874f4eacfeb9dde SHA-1: cb8be8010cab4bf6245a3fdc957f1b29c9b3d1ec SHA-256: 5c441c6c114e2ea29d8c11e9d25f154628a9cd108319435b1766c4fe4cfcf0ec
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and text promoting a "Coin Master Hack Apk", strongly suggesting a lure for users to download potentially unwanted or malicious software. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the lure indicate a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-hack-apk-game-hack PDF link annotation
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/roblox-earn_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-hack-fast_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/hack-coin-master-site-rssingcom_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-hack-tool-download_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-jackpot-madness-hack_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/free-unlimited-robux_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/withdraw-robux_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/get-free-robux-com_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/roblox-login-hack_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/blox-fish-free-robux_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-link-for-spins_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/free-robux-gift-card-codes-2021_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/can-i-get-robux-for-free_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/games-like-coin-master_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-50-spin-link_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/como-hackear-el-juego-coin-master-en-espaol_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-free-spin-and-coin-link-today_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-link-download-hack_GM406889139.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/claim-gg-free-robux_GM431946152.pdfIn PDF document text
    • https://ptun-denpasar.go.id/new/public/ckfinder/userfiles/files/coin-master-hack-apk-android_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004a01.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4A01 23692 bytes
SHA-256: ab59c841a85ea410e86bfdeed08b8e40de723d117b1d43bb4063019917a321f3
font_01_sfnt_off00007fb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FB0 17892 bytes
SHA-256: f939fda97690d6a809d743b342add8ec97984f5e978608423f32dd39679c4d64

Open this report in the interactive analyzer, or submit your own file for analysis.