PDF static analysis report

Static analysis result for SHA-256 a6b87dd76116812a…

SUSPICIOUS

PDF

37.1 KB Created: 2021-05-17 22:11:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: da1ddc0267544206b6c54342dcdfe28f SHA-1: 5ead635f6839f06e2493c0ebd0ffbb6676d6b449 SHA-256: a6b87dd76116812ac29e26e9f0088e5dc0188197f09f414371eb7767fb1d2b6d
54 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains an embedded URL pointing to a "Coin Master Coin Hack", which is a common lure for phishing or scam operations. The ML classifier also flagged this PDF with high confidence. While no scripts were directly executed, the presence of external URLs suggests an attempt to redirect the user to a malicious site. The document body, though partially corrupted, contains text related to game hacks and the suspicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 3

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-coin-hack-game-hack PDF link annotation
    • http://www.imperialaccountingfl.com/images/john-doe-roblox-hacker_GM431946152.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/hackear-juego-coin-master-espaol_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/how-to-change-your-username-in-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/roblox-moderators_GM431946152.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/hacks-for-coin-master_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/how-to-hack-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/mcpe-master-coins-hack-download_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/free-robux-real-working_GM431946152.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/is-minecraft-earth-free_GM479516143.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/minecraft-online-free-no-download_GM479516143.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/coin-master-free-card-link-today_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/coin-master-free-spin-app-2021_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/coin-master-pc-hack_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/smart-lodhi-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/coin-master-hack-co_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/coin-master-hack-without-verification_GM406889139.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/free-robux-no-verification-or-survey_GM431946152.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/free-800-robux_GM431946152.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/how-to-download-minecraft-for-free-on-iphone_GM479516143.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/how-to-hack-a-roblox-account-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004736.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4736 24924 bytes
SHA-256: 13674351fe2f33203eb3573d571368777ba56116e99244e3ffcf696c1a7bf574
font_01_sfnt_off0000807c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x807C 2840 bytes
SHA-256: 3fb127b764b9d10f5525bc4de5ec8316de704409ccb0cf21cff3ad8a30d11676

Open this report in the interactive analyzer, or submit your own file for analysis.