PDF static analysis report

Static analysis result for SHA-256 c5323e90bf30712e…

SUSPICIOUS

PDF

42.1 KB Created: 2021-05-19 01:06:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 000b4c810c2309315daf691ebdfd72a5 SHA-1: 59b7d3aa774132a198d0a179373b1f48c6108bed SHA-256: c5323e90bf30712e6c6519f761f5c2dab1996fc0327945d2567b1b061ac39ce4
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded links that lead to external resources, masquerading as game hacks. The ML classifier strongly indicates maliciousness, and the presence of multiple URLs suggests a downloader or phishing attempt. Although no scripts were explicitly extracted, the PDF format itself can embed JavaScript, which is often used for malicious redirection or exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-1.15-2-hacks-game-hack PDF link annotation
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/how-to-get-free-robux-without-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/coin-master-free-spins-daily-link-game-mod_GM406889139.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/easy-robux-today-com_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/www-roblox-com-robux-free_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/how-to-get-free-coins-in-coin-master_GM406889139.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/coin-master-free-spins-link-march-2021_GM406889139.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/haktuts-coin-master-free-daily-spins_GM406889139.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/coin-master-34-4-hack-download_GM406889139.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/coin-master-spin-hack-2021_GM406889139.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/how-to-get-free-robux-website_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/is-java-minecraft-free_GM479516143.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/robux-fun-hack_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/download-pokemon-go-free_GM1094591345.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/roblox-toy-codes-free_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/cute-free-hair-on-roblox_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/rbx-website_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/free-robux-hack_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/microsoft-roblox_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/free-robux-group_GM431946152.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/roblox-free-robux-codes_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4A8C 24540 bytes
SHA-256: ecf58a3ffc89db966b83308c0b45be7e58803c441426c1e4034860e56397baeb
font_01_sfnt_off000082c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82C7 18168 bytes
SHA-256: db08b96da71f6ddfbe6b519ed50ce659f2c78f4173f4a3128d613ddf1b801d62

Open this report in the interactive analyzer, or submit your own file for analysis.