PDF static analysis report

Static analysis result for SHA-256 badb784b1cf6636d…

SUSPICIOUS

PDF

36.1 KB Created: 2021-05-21 02:39:29 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 9008f3cd54960c4ebf0e57b50a4cce35 SHA-1: 5bf574be2c96bf28db517bdce71478fc54dfb6ab SHA-256: badb784b1cf6636d564878c5007c0b689d95b5959c43929256e59a8f04d61332
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The ML classifier strongly indicated maliciousness, and the document contains multiple embedded URLs pointing to potentially malicious content related to game hacks. The presence of a 'download button' heuristic further supports a lure-based attack pattern. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to redirect the user to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9492

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-pe-hacks-2021-game-hack PDF link annotation
    • https://fridaytravelnepal.com/userfiles/files/mcpe-116_GM479516143.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/how-do-you-hack-roblox_GM431946152.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-robux-on-ipad_GM431946152.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-clothing-on-roblox_GM431946152.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-coin-master-coins-and-spins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000032fb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32FB 25272 bytes
SHA-256: 97c7c26d3b7773c66fbe082685083ccaa3d9dcca91398f5a130d4ad3ab07df39
font_01_sfnt_off00006bf7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BF7 18296 bytes
SHA-256: 928fda8d6cdf740c8aa958f6e9db818f0cdae9318cc1084247adea2ad4ad4e6f

Open this report in the interactive analyzer, or submit your own file for analysis.