PDF static analysis report

Static analysis result for SHA-256 7c48c35d0230c418…

SUSPICIOUS

PDF

46.4 KB Created: 2021-06-08 14:28:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 76c1c20268ff9738d8575b28ecb12e27 SHA-1: 567159b3793bba705055933482a65bd6b58bc0ba SHA-256: 7c48c35d0230c41896a37168ef95fc3753d023a2f55119c6f3adffdf64a9bdc5
50 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The ML classifier strongly indicated maliciousness, and the document contains multiple embedded URLs pointing to sites offering game hacks and cheats. The heuristics for urgency and download buttons suggest a social engineering lure to trick the user into clicking these links. The primary URL is associated with downloading a file related to 'Roblox free game hack'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9832

Heuristics 4

  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/principal-of-the-thing-shirt-roblox-free-game-hack PDF link annotation
    • http://moto98.com/images/legit-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/how-to-get-roblox-money_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/coin-master-offline-hack_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/coin-master-unlimited-spin-link_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/how-to-get-free-robux-app_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/coin-master-hack-app-android_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/how-to-get-free-robux-without-any-verification_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/free-robux-stream_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/free-robux-not-fake_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/coin-master-free-gifts_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/free-robux-games-on-roblox_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/coin-master-hack-game_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/how-to-hack-minecraft-pe_GM479516143.pdfIn PDF document text
    • http://moto98.com/images/coin-master-game-free-spin-download_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/free-minecraft-servers-to-join_GM479516143.pdfIn PDF document text
    • http://moto98.com/images/coin-master-fun-hack-online_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/coin-master-free-stuff_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/free-robux-come_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/best-free-minecraft-texture-packs_GM479516143.pdfIn PDF document text
    • http://moto98.com/images/huskybuscom-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004e61.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E61 29200 bytes
SHA-256: 6a508b26aa12048ba79894aa496621479698f3230a113d771c65928a649cc10f
font_01_sfnt_off00009034.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9034 19184 bytes
SHA-256: 8825851ae1b106ca4e1fde1aa41520eaf84fc5f8b4072271622e8f78ae926549

Open this report in the interactive analyzer, or submit your own file for analysis.