PDF static analysis report

Static analysis result for SHA-256 5d1b419355a3b916…

SUSPICIOUS

PDF

33.5 KB Created: 2021-07-21 06:21:03 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 45e099c22a38071ffbb265b3568b3a90 SHA-1: 59c36e3ef4ad87b130f22bb50d0e9e3bd137bb74 SHA-256: 5d1b419355a3b9169d21cef13deef04f79d15375cd26c7bd6f382a1ba7fde706
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a prominent link and text suggesting a download, which is a common lure for users to obtain potentially unwanted or malicious software. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple URLs pointing to download sites reinforces this assessment. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/minecraft-pe-0.15-0-apk-free-download-game-hack PDF link annotation
    • https://ths-academy.net/wp-content/uploads/fsqm-files/free-followers-for-tiktok_GM835599320.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/how-to-get-minecraft-bedrock-for-free_GM479516143.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/free-robux-for-kids_GM431946152.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/free-minecraft-alts_GM479516143.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/how-to-get-free-tiktok-coins_GM835599320.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/free-robux-hack-generator_GM431946152.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/roblox-hack-me_GM431946152.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/free-tiktok-likes_GM835599320.pdfIn PDF document text
    • https://ths-academy.net/wp-content/uploads/fsqm-files/ways-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002bfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BFA 22500 bytes
SHA-256: d8a826ac094446d47f4c4f890abd69f66e960dfde4c858aea78ec3f01dc070f3
font_01_sfnt_off00005dfc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5DFC 19268 bytes
SHA-256: 9273c8c2b8a269721a9438858e1c0aeb95c142b4551f9d4ca11e724d76d79d6e

Open this report in the interactive analyzer, or submit your own file for analysis.