PDF static analysis report

Static analysis result for SHA-256 5e3529f333c73b13…

SUSPICIOUS

PDF

34.2 KB Created: 2021-06-18 03:38:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: b15358c2102bee98f5ed6bce603476a0 SHA-1: 756f8b3b28def5f6012233999ffdd410cfea46d0 SHA-256: 5e3529f333c73b138035ad2d469055c193ec43664cb3ebcb6853aa533f84ccc4
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are related to game hacks and cheats for popular games like Roblox and Coin Master. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests an attempt to redirect the user to a potentially harmful resource. The document body, though partially corrupted, also contains references to these game hacks and a URL that likely serves as the primary download lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-admin-accounts-game-hack PDF link annotation
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-coin-master-gold-cards_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/coin-master-hack-2021-free_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-robux-2021-19-pastebin_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/http-bit-ly-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/minecraft-windows-10-edition-hacks_GM479516143.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/games-roblox-hack_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/coin-master-hack-ios-2021_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-hack-anyone-on-roblox_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/haktuts-coin-master-spins_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-flip-master-coins_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/more-robux_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/coin-master-free-daily-spins-link_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-spin-coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-apocalypse-rising-hack_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/hacked-client-for-minecraft-bedrock_GM479516143.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-free-download-pc-microsoft_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-bots-free-game_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-robux-gift-card-codes-2021-december_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-get-free-roblox-items-2021_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/where-to-enter-free-robux-codes_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003205.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3205 21040 bytes
SHA-256: 73ade48f4065a8e22f4d8262106d1d792f7e9d011bfd39096e7a79ab5d5694d6
font_01_sfnt_off00005fa5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5FA5 19448 bytes
SHA-256: 9b8d509c86933358fe34d8f10377a8a3b236880b54d60b262dafa3a5e21d8d29

Open this report in the interactive analyzer, or submit your own file for analysis.