PDF static analysis report

Static analysis result for SHA-256 66341f86bf064732…

SUSPICIOUS

PDF

45.2 KB Created: 2021-05-10 19:33:18 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 61876407bf9267207a8403556c680af5 SHA-1: 30c9ee23b711925a8e9b22ed126097852515e210 SHA-256: 66341f86bf064732b76d7f4ffed4d2fd61accea8578917c6eacaf95aa890f97e
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs that advertise hacks for popular games, suggesting a lure for users to download potentially malicious software. The ML classifier also flagged this PDF as malicious. While no scripts were directly extracted, the presence of external URIs and the document's deceptive content strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9621

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-hack-with-lucky-patcher-game-hack PDF link annotation
    • http://lib.teknik.unimal.ac.id/repository/coin-master-hack-100-working_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/how-do-i-get-free-spins-in-coin-master_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/hacks-for-roblox-jailbreak_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/get-me-free-robux_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/coin-master-free-spins-link-no-verification-2021_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/coin-master-spin-free_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/free-robux-exe_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/free-robux-no-verification-or-survey_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/minecraft-bedrock-edition-free-with-java_GM479516143.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/free-spins-on-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/coin-master-free-spins-link-2021-today_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/how-to-get-minecraft-for-free-on-ps4-2021_GM479516143.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/how-to-hack-roblox-passwords_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/roblox-font-free_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/coin-master-free-spins-link-today-twitter_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/how-to-cheat-in-roblox_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/roblox-hack-download_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id//repository/freespinandcoinblogspotcom-2021-11-coinmasterfreespinandcoinlinkshtml_GM406889139.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/free-robux-no-verification-no-download-2021_GM431946152.pdfIn PDF document text
    • http://lib.teknik.unimal.ac.id/repository/coin-master-free-coins-amp_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004987.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4987 25560 bytes
SHA-256: bb3379671d4465424dd326430405f86f0f6e1e7f2c091e408a1b86d9781e19bf
font_01_sfnt_off0000835a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x835A 2880 bytes
SHA-256: 10d025f04f706eb71cdda4f99784df1b9ccb52e48080e43095e0398eaef6f132
font_02_sfnt_off00008d44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D44 18552 bytes
SHA-256: 0dcb3a2c40d52ee7866e827a4899733df9c94cbb58243ba2d3547582b3d1f053

Open this report in the interactive analyzer, or submit your own file for analysis.