PDF static analysis report

Static analysis result for SHA-256 780c8332fa92a1c9…

SUSPICIOUS

PDF

33.5 KB Created: 2021-07-05 01:23:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9ed5aa81a74acd9a848aa9932f9b94cd SHA-1: def9e24ac3eb5df178dade1b679d295a28498621 SHA-256: 780c8332fa92a1c9edee649839bbb5696329dbbf0b67c87acad3283ce89c6d13
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains an external URI pointing to a "minecraft-game-hack" download, strongly suggesting a lure for users seeking cheats or exploits. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the lure indicate an attempt to deliver a malicious payload, likely through a user-initiated download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/minecraft-game-hack PDF link annotation
    • http://opac.salatiga.go.id/slims7/repository/free-robux-promo-generator_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/greenlegocats-how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/coin-master-free-spins-daily_GM406889139.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/best-free-roam-games-on-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/wie-kann-man-auf-roblox-hacken_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-hack-buildermans-password-on-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/how-to-get-free-hats-on-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/roblox-fun-com-free-robux_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/free-daily-spins-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/get-free-robux-tips-and-tricks_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/free-candy-hack-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/comment-hack-un-compte-roblox-2021_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/free-coin-master-spins-for-today_GM406889139.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/free-roblox-shirt-templates-2021_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-hack-to-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/i-get-free-robux_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/minecraft-java-edition-free_GM479516143.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-get-free-robux-on-ipad-2021_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/coin-master-free-spins-may-11-2021_GM406889139.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/hacks-for-ninja-legends-simulator-for-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003036.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3036 22292 bytes
SHA-256: afba2d804c1ce4bb46bf867354772e913b90b90f6582b9f3f01cfe33e1aafb4e
font_01_sfnt_off000061a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61A1 17856 bytes
SHA-256: 18153eb78e52d10f573a403757bf08b8b042ff0dae7dd3b4cc440df27f37a65e

Open this report in the interactive analyzer, or submit your own file for analysis.