PDF static analysis report

Static analysis result for SHA-256 b4cc188c8750689d…

SUSPICIOUS

PDF

42.9 KB Created: 2021-05-17 07:42:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 48a386afa09cd0d710d94ee9575419bb SHA-1: 11bb90f3a7b3438ae6d3b7e8f03a32628c53bb4a SHA-256: b4cc188c8750689d868ebe798d2e0743b0be4bcc7e59e040ed440e7d6563d19b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains embedded URLs and a visual download button lure, strongly suggesting it is designed to trick users into downloading malicious content. The ML classifier also flagged this PDF with high confidence. The primary URL points to a "coin-master-today-game-hack", indicating a social engineering pretext for malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-today-game-hack PDF link annotation
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/free-roblox-hack-us_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/how-to-get-free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/roblox-hacking-website_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/get-more-robux_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/how-to-use-scripts-in-roblox-hack_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/coin-master-hack-apk-android_GM406889139.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/how-to-get-free-roebucks_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/coin-master-hacks-2021_GM406889139.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/free-robux-generator-without-verification_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/coin-master-gold-cards-hack-2021_GM406889139.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/free-minecraft-codes-2021_GM479516143.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/how-to-get-minecraft-for-free-on-mac_GM479516143.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/how-to-get-free-spins-on-coin-master-blogspot_GM406889139.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/robuxfree-con_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/links-to-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/earn-robux-for-roblox_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/coin-master-hack-ios-no-verification_GM406889139.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/free-robux-not-a-scam_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/how-do-you-get-roblox-money_GM431946152.pdfIn PDF document text
    • http://elearningmi.mibustanululumtulungagung.com/__statics/gudangsoal/files/can-you-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004ba3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4BA3 25764 bytes
SHA-256: 297110753374aa93c378631c4a81a5d3d207dec777fa755b1e9cb87cd3200e46
font_01_sfnt_off0000865a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x865A 17900 bytes
SHA-256: 4d8f4d30bf6ed32ab69c0e3c6b9d13f3aedccf41ef86a94604d61125f9e6c526

Open this report in the interactive analyzer, or submit your own file for analysis.