PDF static analysis report

Static analysis result for SHA-256 86dfc268706720f1…

SUSPICIOUS

PDF

36.0 KB Created: 2021-07-07 17:48:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 78374140e46f33d820e81c9f34d8eb4e SHA-1: 1156f93ddc0617030d1e7dee6ed42c25da5f8083 SHA-256: 86dfc268706720f117a0b960c41a474b1e1ac6821e80e9964f1d73bc3419c38b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains embedded URLs and a document body that lures users with promises of free items for online games. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests an attempt to redirect users to download further content. The document's purpose appears to be a phishing or scam attempt, likely leading to malware download or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/how-to-get-free-roblox-items-game-hack PDF link annotation
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/how-do-you-hack-roblox_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/roblox-studio-free-download_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/coin-master-reward-link_GM406889139.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/roblox-blood-of-iron-hack_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/como-hackear-coin-master_GM406889139.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/free-robux-form-ylow_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/free-robux-de-2021_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/how-to-hack-roblox-games_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/roblox-source-code-hack_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/minecraft-noob-vs-pro-vs-hacker-vs-god_GM479516143.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/free-spins-coin-master-app-iphone_GM406889139.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/free-robux-promo-codes-gen-2_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/free-online-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/how-to-get-free-spins-on-coin-master-2021-ios_GM406889139.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/hack-coin-master-apk-2021_GM406889139.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/how-to-hack-roblox-ios-2021_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/free-spins-coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/how-to-get-free-robux-on-iphone_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/how-to-buy-robux-for-free_GM431946152.pdfIn PDF document text
    • http://www.wrlshipping.com/uploaded_files/userfiles/files/free-robux-pin-codes-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000336c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x336C 23056 bytes
SHA-256: 52187fe372017c4743a37965b33bffdfc0d716501c6d5eec2e9ba93628342b21
font_01_sfnt_off0000677f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x677F 19176 bytes
SHA-256: 1bbd74c885478b6da8ac526caf82807791560f3be56a03a53783c17cf6598e07

Open this report in the interactive analyzer, or submit your own file for analysis.