PDF static analysis report

Static analysis result for SHA-256 c8b4edba6f7e4fc7…

SUSPICIOUS

PDF

33.5 KB Created: 2021-06-21 22:45:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: a5caf4790a6368d7930207e5494f5e7c SHA-1: ed855b005fa33d7ad62f7b4a85522d5055fdfd69 SHA-256: c8b4edba6f7e4fc7b88599594cc0c2eed62db268d69b49809610845d53dd9673
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier strongly indicates maliciousness, and the document body contains numerous URLs advertising game hacks and cheats. The presence of embedded URLs and the overall theme suggest a lure to download potentially unwanted or malicious software. No scripts were extracted from this sample, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/406889139/coin-master-shield-hack-game-hack PDF link annotation
    • https://new.minsatulearning.com/__statics/gudangsoal/files/robux-free-c_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/free-robux-with-no-human-verification_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/minecraft-apk-114_GM479516143.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/hack-de-coin-master_GM406889139.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/minecraft-free-computer-game_GM479516143.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/how-to-get-java-minecraft-free_GM479516143.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/roblox-free-items-glitch_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/free-robux-no-verification-2021-ios_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/free-minecraft-java-edition-account_GM479516143.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/legitimate-coin-master-free-spins-apk_GM406889139.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/get-free-robux-info_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/free-tiktok-video_GM835599320.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/coin-master-free-spins-hack-no-human-verification_GM406889139.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/huskybuckscom-free-robux_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/roblox-free-vip-server_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/free-promo-codes-for-roblox-2021_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/free-coin-master-hacks_GM406889139.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/rbxoffers-com-free-robux_GM431946152.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/coin-master-daily-free-spins-2021_GM406889139.pdfIn PDF document text
    • https://new.minsatulearning.com/__statics/gudangsoal/files/coin-master-hack-review_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FED 21832 bytes
SHA-256: 83796a1bde8a05a7954a4dd1a8587fe092d3d97de0900ebdf93b3d5d54e41e21
font_01_sfnt_off00005ffc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5FFC 18420 bytes
SHA-256: 7a9fefd32bb25fd2ee2db65b7df48dc6e1a90cf159b4f78d2ec6688aae885285

Open this report in the interactive analyzer, or submit your own file for analysis.