PDF static analysis report

Static analysis result for SHA-256 981ba15cd766d7f0…

SUSPICIOUS

PDF

35.0 KB Created: 2021-06-22 23:23:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: e88c82543ee809143e228f4d321d592c SHA-1: 77c22f451c4f4a218531f13a310df89e1cf19680 SHA-256: 981ba15cd766d7f0ac90b1a875df5cb004151e5841286d36fa622e308acb0216
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and text referencing free game items, strongly suggesting a lure for users to download potentially malicious content. The ML classifier also flagged this PDF with high confidence. While no scripts were directly extracted, the presence of external URIs and the document's content indicate an attempt to trick users into visiting malicious sites, likely as part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-account-generator-obc-game-hack PDF link annotation
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/coin-master-hack-https-coinms-net_GM406889139.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/minecraft-java-edition-free-download_GM479516143.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/free-coin-master-spins-2021_GM406889139.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/but-link-says-free-robux_GM431946152.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/free-roblox-codd_GM431946152.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/robux-hack_GM431946152.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/100-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/roblox-hack-site_GM431946152.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/minecraft-free_GM479516143.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/watch-tiktok-for-free_GM835599320.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/coin-master-reward-link-2021_GM406889139.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/minecraft-build-hacks_GM479516143.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/coin-master-free-spin-and-coin_GM406889139.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/how-to-get-free-items-in-roblox-tagalog-2021-febuary_GM431946152.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/free-spin-codes-coin-master_GM406889139.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/coin-master-free-spins-link-today-blogspot_GM406889139.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/rbl-gg-free-robux_GM431946152.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/how-to-get-free-robux-without-verifying-2021_GM431946152.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/minecraft-java-edition-free-code_GM479516143.pdfIn PDF document text
    • http://thcsducthang.pgdbactuliem.edu.vn/ckfinder/userfiles/files/how-to-download-minecraft-java-edition-for-free_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003273.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3273 22312 bytes
SHA-256: b253ac83933dab1b7186bb73cc55e376d5bbf54493c7bb30ac5f6643069ee52e
font_01_sfnt_off00006433.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6433 18896 bytes
SHA-256: df41bbc29a973ebb48dee788dd477ec9dcc4b6e4b797e1ec79fff18f332ff4e6

Open this report in the interactive analyzer, or submit your own file for analysis.