PDF static analysis report

Static analysis result for SHA-256 92631ba01143bae1…

SUSPICIOUS

PDF

36.3 KB Created: 2021-05-21 09:13:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6a27e51f3d211d4975639a9fe2149c03 SHA-1: 6563396c270d6698ad34596bc4e85f2f5bfa0aea SHA-256: 92631ba01143bae1828b91e47b80d085f1cabb355c6d7456db326191a8b63cd0
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs pointing to potentially malicious files, disguised as game downloads. The ML classifier strongly flagged this PDF as malicious. The document body includes a call-to-action phrase and references a URL that likely serves as a download link for a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9492

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-world-free-download-game-hack PDF link annotation
    • http://j-cook.pro/images/roblox-hack-com_GM431946152.pdfIn PDF document text
    • http://j-cook.pro/images/pokemon-go-free-2021_GM1094591345.pdfIn PDF document text
    • http://j-cook.pro/images/free-robux-giveaway-live_GM431946152.pdfIn PDF document text
    • http://j-cook.pro/images/www-free-robux_GM431946152.pdfIn PDF document text
    • http://j-cook.pro/images/how-to-get-100-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000337c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x337C 24656 bytes
SHA-256: 7ef5ab4647c1f18d15db8701dd287165fcf2c2adc1650530513d50144ca346a1
font_01_sfnt_off00006bc0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BC0 18488 bytes
SHA-256: 53d97953320c4a27ca75ab54c15cccabcbe94f1a7eef6df1be3b25df4f56750c

Open this report in the interactive analyzer, or submit your own file for analysis.