PDF static analysis report

Static analysis result for SHA-256 d5944c34599718fc…

SUSPICIOUS

PDF

29.4 KB Created: 2021-07-19 00:05:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 92b5ef5d97b88e2f1b8fc8546004ccab SHA-1: dc3eed4a7c8e41d814519bc0585be038eadbf31e SHA-256: d5944c34599718fc46ef3a740f36e746a1d552b73bd572350c0f48703861f4ae
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded links and text promoting a "Coin Master Links Free Spins" generator, with a clear call to action to "CLICK HERE TO ACCESS COIN MASTER GENERATOR". The primary malicious URL, http://netcdn.tw/app/406889139/coin-master-links-free-spins-game-hack, is directly referenced in the document body and heuristics. While no scripts were explicitly extracted, the ML classifier and embedded URI heuristics strongly indicate malicious intent, likely to deliver a second-stage payload or redirect to a phishing/scam site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8506

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-links-free-spins-game-hack PDF link annotation
    • https://marielyst-grundejerforening.dk/images/minecraft-windows-10-free-with-java_GM479516143.pdfIn PDF document text
    • https://marielyst-grundejerforening.dk/images/free-robux-script_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000020aa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x20AA 22256 bytes
SHA-256: 621b828bbf4c4bcd9f544fb272ef843e06c9d93758325b512322fd039e0711a9
font_01_sfnt_off000051f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x51F1 18056 bytes
SHA-256: 95118de0f1fa2d9d8d6d34d7ce9f6e9c56d43c25fce4d2a4bd556d275959b9e0

Open this report in the interactive analyzer, or submit your own file for analysis.