PDF static analysis report

Static analysis result for SHA-256 69a4cd935004e1c7…

SUSPICIOUS

PDF

42.4 KB Created: 2021-05-13 07:39:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6ff35e422f04af6ee88f66353de70298 SHA-1: db7a76cfd84d2506257f6bf665a4d726db446349 SHA-256: 69a4cd935004e1c75be22d37c43f32edb386bbe5b2b23d72ff2a7b9ecaf29c16
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs pointing to sites offering game cheats and hacks, strongly suggesting a lure for users to download potentially malicious content. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of external URIs and the nature of the lures indicate a phishing or social engineering attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-free-coins-and-spins-game-hack PDF link annotation
    • https://easypay.af/uploaded_files/userfiles/files/toolbox-for-minecraft-pe_GM479516143.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/how-do-you-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/minecraft-hack-download_GM479516143.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/robloxbux-us-generator_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/blogspot-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/oprewards-free-robux_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/blogger-free-spins-and-coins_GM406889139.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/free-spins-coin-master-cheats_GM406889139.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/hack-roblox-players_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/minecraft-linux-free_GM479516143.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/how-to-hack-roblox_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/como-hackear-coin-master-espaol_GM406889139.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/free-roblox-executor-no-key_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/robux-hack-generator_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/free-robux-glitch-2021_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/how-to-win-free-robux_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/how-to-earn-free-robux_GM431946152.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/coin-master-pet-food-hack_GM406889139.pdfIn PDF document text
    • https://easypay.af/uploaded_files/userfiles/files/coin-master-email-free-spins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004b7c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B7C 25644 bytes
SHA-256: 037a3da0ef428bed868756d720d92abd88562479c3a78195a754896fa53ba61b
font_01_sfnt_off00008410.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8410 18060 bytes
SHA-256: f77ee24e01944806ea28e16fd73427a54f7109e241804df06ce657d8c6d11cfb

Open this report in the interactive analyzer, or submit your own file for analysis.