PDF static analysis report

Static analysis result for SHA-256 b8a6be6d946ab929…

SUSPICIOUS

PDF

35.5 KB Created: 2021-07-05 03:59:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 65944cb2d0a2128eeb19ad084b866115 SHA-1: 24fe3ed9490359358170056d003e88652e2150ae SHA-256: b8a6be6d946ab9296e605a9d2b4cb5f3b346e70c9908073331e65f7ad9657de8
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a call-to-action phrase, strongly suggesting a social engineering lure. The primary URL, http://netcdn.tw/app/406889139/coin-master-code-for-free-spins-game-hack, indicates a scam related to game cheats. While no scripts were explicitly extracted, the ML classifier flagged this PDF with high confidence as malicious, and the presence of numerous suspicious URLs points to a likely download or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-code-for-free-spins-game-hack PDF link annotation
    • http://perpustakaan.dutadharma.ac.id/repository/lego-hack-download-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/get-robux-for-free-without-human-verification_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/welcome-to-farmtown-hacks-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/spin-and-coin_GM406889139.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/how-to-get-free-robux-on-ipod-touch_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/how-to-code-a-script-hack-for-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/how-to-hack-roblox-accounts-with-cheat-engine-62-2021_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/roblox-shard-seekers-hack_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/dead-winter-hack-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/free-robux-on-ipad-and-withoutb-downloading-anything_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/free-gift-codes-for-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/how-to-get-free-robux-without-paying_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/roblox-notoriety-hack_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/roblox-free-robux-no-human-verification_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/robux-hack-top-2021_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/free-robux-rbxboost_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/how-to-hack-and-get-robux-2021_GM431946152.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/minecraft-education-free_GM479516143.pdfIn PDF document text
    • http://perpustakaan.dutadharma.ac.id/repository/roblox-stranger-things-promo-codes-cheat_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000344b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x344B 23076 bytes
SHA-256: a03b8292d6070f47ce98414e514130d34e5aedf2dd6b57ca535b83a5fc6a424e
font_01_sfnt_off00006809.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6809 18348 bytes
SHA-256: 39fb35d261283ade411aa785f7d5e71fc568a3033ce7fb3bd164da5f03d5b1f7

Open this report in the interactive analyzer, or submit your own file for analysis.