PDF static analysis report

Static analysis result for SHA-256 61f13c134670c0be…

SUSPICIOUS

PDF

33.6 KB Created: 2021-06-30 01:36:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: cecbe497990fe8e8857f9a700361a20c SHA-1: d2d8a84c49747abe701886e3c3e604cbd58267a9 SHA-256: 61f13c134670c0be998b67946647cf18be6f00546234ae19d457c3eb387462b1
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains numerous embedded URLs and a document body that promotes 'hacks' and 'free items' for games, strongly suggesting a lure for users to download malicious content. The ML classifier also flagged this PDF as malicious with high confidence. The primary attack pattern involves tricking users into downloading further malware via the provided links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/hacks-for-pet-sim-roblox-game-hack PDF link annotation
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/games-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/how-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-gold-cards-coin-master_GM406889139.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/how-hack-roblox-servers_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-robux-with-no-human-verification_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-roblox_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/pubg-uc-quiz_GM1330123889.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/how-to-get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-minecraft-skins-pc_GM479516143.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/coin-master-spin-hack-no-human-verification_GM406889139.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/websites-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/roblox-robux-hack-zone_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-spins-coin-master-cheat_GM406889139.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/hacks-for-flora-frenzy-roblox_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/is-minecraft-free-on-xbox-one_GM479516143.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-coin-master-spins-2021_GM406889139.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-robux-no-human-verification-or-survey-2021_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/haktuts-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/roblox-rs16-5-hacks_GM431946152.pdfIn PDF document text
    • http://www.hiddencanyonbejiguwang.com/assets/CKImages/files/free-unlimited-coin-master-400-spin-link_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002bcb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BCB 22384 bytes
SHA-256: 959d203a9903dab9e43a6ee1e056c3ca3ec764e72325069a3c5a1dba9d954e0a
font_01_sfnt_off00005d80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D80 19456 bytes
SHA-256: 3a49d0e65042ec5f9f48107a63c4696806553f94bc7315856b996257553cba1b

Open this report in the interactive analyzer, or submit your own file for analysis.