PDF static analysis report

Static analysis result for SHA-256 b8e7a1b12cfa4898…

SUSPICIOUS

PDF

50.7 KB Created: 2021-06-03 09:44:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 1d1f633474538e77fee5ce68c0fbf2fa SHA-1: 8cb38b6db4155d5082f5845f783747a13bb899b6 SHA-256: b8e7a1b12cfa4898229577214200ba2f1b0b047fa315dc8520109c18f25a117b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains an external URI pointing to a website offering 'Coin Master Free Coins and Spins App', and numerous other URLs related to game cheats and free accounts. The ML classifier also flagged this PDF as malicious. The presence of a visual download button lure further supports the conclusion that this document is designed to trick users into downloading potentially unwanted or malicious applications.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9713

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/coin-master-free-coins-and-spins-app-game-hack PDF link annotation
    • http://oca.undil.tl/repository/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/roblox-builders-club-free_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/free-robux-without-downloading-anything_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/coin-master-hack-without-human-verification_GM406889139.pdfIn PDF document text
    • http://oca.undil.tl/repository/free-unlimited-robux_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/get-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/cool-free-minecraft-skins_GM479516143.pdfIn PDF document text
    • http://oca.undil.tl/repository/roblox-games-com-free_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/free-2021-robux_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/free-minecraft-coloring-pages_GM479516143.pdfIn PDF document text
    • http://oca.undil.tl/repository/best-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://oca.undil.tl/repository/how-to-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://oca.undil.tl/repository/free-coin-master-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://oca.undil.tl/repository/how-to-get-free-robux-games_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/how-do-you-hack-roblox_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/ways-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/easy-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://oca.undil.tl/repository/coin-master-free-coins-link-2021_GM406889139.pdfIn PDF document text
    • http://oca.undil.tl/repository/minecraft-apk-download-v1-144-2-free_GM479516143.pdfIn PDF document text
    • http://oca.undil.tl/repository/how-do-u-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005114.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5114 27792 bytes
SHA-256: 2ba09ffc8a562f1182a4a8eefd04e010c059baad7d079cd93a50838fa71e96fe
font_01_sfnt_off00008fd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8FD3 2812 bytes
SHA-256: 869414959d7b492e0f799b560e1731e3ab498bd286c28e9f0d2ec33d9b6cf53d
font_02_sfnt_off00009972.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9972 18060 bytes
SHA-256: f77ee24e01944806ea28e16fd73427a54f7109e241804df06ce657d8c6d11cfb
font_03_sfnt_off0000bac8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAC8 3264 bytes
SHA-256: e32c06502c11b52acb5e814091c5fdbffd1e2a904ac7a9cfb8b5b180bd139088

Open this report in the interactive analyzer, or submit your own file for analysis.