PDF static analysis report

Static analysis result for SHA-256 c18276f990c8fcc9…

SUSPICIOUS

PDF

41.2 KB Created: 2021-05-17 21:55:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6e789a2476f40f363644c02d966790a7 SHA-1: 644e4d50f3a95ef3340958aedcad779ec1ee4d94 SHA-256: c18276f990c8fcc91b90e31a826809a4a83cf1106e84e2d1f5a881cd411174ce
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a heuristic firing for a visual download button, suggesting a phishing or scam attempt. The ML classifier also flagged the PDF as malicious with high confidence. The document body and embedded links point towards lures for free spins, game hacks, or in-game currency, which are common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-free-spins-link-march-2021-game-hack PDF link annotation
    • http://jdlwealth.com/images/how-can-i-play-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://jdlwealth.com/images/free-custom-minecraft-skins_GM479516143.pdfIn PDF document text
    • http://jdlwealth.com/images/how-to-really-hack-coin-master_GM406889139.pdfIn PDF document text
    • http://jdlwealth.com/images/free-robux-wheel_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/free-robux-only-1-step_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/robux-hack-me_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/free-robux-games-that-actually-work-2021_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/earn-robux-sites_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/microsoft-free-robux_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/minecraft-free-download-mac-full-version_GM479516143.pdfIn PDF document text
    • http://jdlwealth.com/images/how-can-u-get-free-robux_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/robux-only_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/free-robux-sites-that-work_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/how-to-hack-coin-master_GM406889139.pdfIn PDF document text
    • http://jdlwealth.com/images/free-vpn-for-minecraft_GM479516143.pdfIn PDF document text
    • http://jdlwealth.com/images/coinmaster-blogspot_GM406889139.pdfIn PDF document text
    • http://jdlwealth.com/images/coin-master-free-daily-spins-link_GM406889139.pdfIn PDF document text
    • http://jdlwealth.com/images/coin-master-how-to-get-japan-sushi-card-free_GM406889139.pdfIn PDF document text
    • http://jdlwealth.com/images/free-robux-hack-generator_GM431946152.pdfIn PDF document text
    • http://jdlwealth.com/images/haktuts-coin-master-today_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000471a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x471A 23864 bytes
SHA-256: b81331e99f3f3565f0c5c75aed044ef28c9d61d57b0d4a967d6c9ebc455c501b
font_01_sfnt_off00007d89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D89 18624 bytes
SHA-256: 17ae697fe1faa2b47d5d7fe02de97643fbc2aded912564a57d22c3ae5ceac2c2

Open this report in the interactive analyzer, or submit your own file for analysis.