PDF static analysis report

Static analysis result for SHA-256 d5aaa8c00da140a8…

SUSPICIOUS

PDF

35.6 KB Created: 2021-07-04 11:40:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: b36fe3f83e64710f92d6ec7e8c69f380 SHA-1: 700e7c12b5f7319df02072ee3c71fa212281c36e SHA-256: d5aaa8c00da140a8abd74727fe54073b00c4551fc189d7efb7e4e770d5a410b9
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a prominent external URI pointing to download sites for game hacks, specifically for Coin Master and Roblox. The ML classifier flagged this PDF with high confidence, indicating malicious intent. The document body text and heuristics suggest a social engineering lure to trick users into downloading potentially unwanted or malicious applications.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-unlimited-coins-hack-apk-download-game-hack PDF link annotation
    • http://library.yamasi.ac.id/repository/free-roblox-expoit-may-2021_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/how-to-get-free-robux-no-hack-or-inspect_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/free-robux-discord-servers_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/comment-hack-sur-roblox-admin_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/coin-master-levels_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/get-roblox-free-online_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/how-to-get-robux-for-free-2021-no-survey_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/free-items-in-roblox-2021_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/coin-master-hack-download-apk_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/android-coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/coin-master-free-spins-hack-link_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/coin-master-hack-com_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/roblox-chat-script-hack_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/today-coin-master-free-coins-link_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/is-roblox-hacked_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/https-iosgodscom-topic-20218flipmastercoinshack_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/free-clothing-on-roblox_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/minecraft-free-play-now_GM479516143.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/free-minecraft-printables_GM479516143.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/inappropriate-roblox-games-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000031d3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x31D3 23036 bytes
SHA-256: d07098275f32b0eb96f588f71ab347d04c4c730673536f8c9d995e96ef51b867
font_01_sfnt_off0000659f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x659F 19208 bytes
SHA-256: ac8a1cc94d9adebce7336fc1630e3f53360c4b0eb9ab9d36c6a158ed54cc7f68

Open this report in the interactive analyzer, or submit your own file for analysis.