PDF static analysis report

Static analysis result for SHA-256 b7672fedc8264ad6…

SUSPICIOUS

PDF

46.6 KB Created: 2021-05-15 03:07:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 79e0d59a2aa9b6605515d0676d8d54de SHA-1: 130e3c50586b1c1ebb60e41e45654dcfe6d1259c SHA-256: b7672fedc8264ad6288807ab2195484cef578e6ba8ffee5ecedf670ed3f78128
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains embedded URLs and a visual lure for a download, strongly suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of external URIs and the document's content indicate an attempt to redirect the user to potentially malicious content, likely a game hack or exploit site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8948

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-15-free-spin-link-of-last-5-days-game-hack PDF link annotation
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/coin-master-hack-without-human-verification-india_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/coin-master-spin-ml-link_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/coin-master-free-daily-spins-link_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/is-coin-master-hack-safe_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/free-robux-stream_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/free-robux-generator-no-survey-no-download-no-human-verification_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/plug-toolbox-for-minecraft-free-ios_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/free-coin-master-gifts_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/codes-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/coin-master-free-spins-link-today-twitter_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/coin-master-hack-ios-app_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/best-free-robux-sites_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/coin-master-free-spin-and-coin-links_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/how-to-get-free-roebucks-in-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/robux-fun-hack_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/minecraft-for-laptop-free_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/roblox-executor-free-download_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/roblox-hackers-list_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/coin-master-free-spins-iphone_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn3mojokerto.sch.id/__statics/gudangsoal/files/collect-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004fc4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4FC4 24896 bytes
SHA-256: e16f5da4e6c6a2443bca8ad6f6812a2592ea06e02dc4022d577bb079c5d78645
font_01_sfnt_off000087dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x87DD 3124 bytes
SHA-256: 9967c6221325a4ff3f7c4336922605f990450164c2eee2df708cc81823c6ec98
font_02_sfnt_off000092bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92BC 18644 bytes
SHA-256: 4144dbe1534d0325d37e4c6129895ddb34a2bc26123e242025982d4ceef1bd2b

Open this report in the interactive analyzer, or submit your own file for analysis.