PDF static analysis report

Static analysis result for SHA-256 8c11336cafd9962f…

SUSPICIOUS

PDF

40.1 KB Created: 2021-05-15 15:20:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 5e5e00041557b329d53562f4217fe69a SHA-1: 210c99b8d564c1c0a5b1a5e24fd07369c06a791a SHA-256: 8c11336cafd9962ffc3a015da4e1beba1bb8e7523264064047c423acf883cd99
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a visual call-to-action, strongly suggesting it is designed to trick users into downloading external content. The ML classifier also flagged this PDF as malicious. The presence of multiple URLs related to game 'hacks' and 'cheats' indicates a social engineering lure for potentially unwanted or malicious applications.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-apk-hack-3.5-8-game-hack PDF link annotation
    • http://zercalo.org/images/apk-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/roblox-hacked-com-2021_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/no-robux_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-do-you-get-free-roblox_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-free-robux-in-2021_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-2021-robux-for-free_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-online-free-spin_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/how-do-i-get-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/roblox-login-hack_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/free-roblox-accounts-generator_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-hack-apk-2021-ios_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/free-script-executor-roblox_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-free-spins-daily-fb-champion_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-free-spins-link-blogspot-today_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-hack-355_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-hack-mod-apk-35-8_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/freespincoin-masterlinkdownload_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/free-robux-survey_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004450.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4450 23572 bytes
SHA-256: e2f92bbc845bd279d45e2c8f79afba35e576e85e5f6d80ffc5d433e8c805f630
font_01_sfnt_off0000799b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x799B 18476 bytes
SHA-256: b9b6adf449100deb59ed95ea3ad5e02aaf3681432d01b6b7dc02955a5f5017fc

Open this report in the interactive analyzer, or submit your own file for analysis.