PDF static analysis report

Static analysis result for SHA-256 903479cd901f833b…

SUSPICIOUS

PDF

34.7 KB Created: 2021-07-05 12:54:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: a095454d0b60d4726a338755e3f25aac SHA-1: 3b64a48a4a4084173b3c5cf0e2b2ed75f360d8b6 SHA-256: 903479cd901f833b93046cea32fb81752e636e8e4ed94923e6ccfe9ade4cc92e
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a document body that suggests a lure for free in-game items or cheats, specifically mentioning 'Free Likes For Tiktok' and various game-related terms. The ML classifier strongly flagged this PDF as malicious, and an external URI was identified pointing to a suspicious domain. While no scripts were explicitly extracted, the presence of embedded URLs and the document's content indicate an attempt to trick the user into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/835599320/free-likes-for-tiktok-game-hack PDF link annotation
    • https://laokhwanhos.com/ckfinder/userfiles/files/how-to-start-a-minecraft-server-for-free_GM479516143.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/op-rewards-robux_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/free-spin-links-coin-master-october-30-2021_GM406889139.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/coin-master-mod-free-download_GM406889139.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/roblox-hacks-jailbreak-wearedevs_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/beast-mode-face-roblox-free_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/roblox-free-robux-generator_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/how-to-get-free-robux-generator_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/robux-hack-2021_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/free-robux-websites-no-human-verification_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/free-spins-for-coin-master-app_GM406889139.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/gun-hacks-for-roblox-2021_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/joedaddy-free-robux_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/free-robux-no-human-verification-and-no-tasks_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/roblox-t-shirt-free_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/free-robux-come_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/cheat-undetectetble-roblox_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/free-robux-adopt-me_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/counter-roblox-hacked_GM431946152.pdfIn PDF document text
    • https://laokhwanhos.com/ckfinder/userfiles/files/free-printable-minecraft-coloring-pages_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003221.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3221 22800 bytes
SHA-256: 88d21abdd7d2b0ff186670c1f67e8e3dc573b9c69eed3f559aced635bcfcb0dd
font_01_sfnt_off000065c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65C2 17972 bytes
SHA-256: 8a36e3043d2485bb5323346b18107ee212cc68c5b206f03205eb9a55f538c932

Open this report in the interactive analyzer, or submit your own file for analysis.