PDF static analysis report

Static analysis result for SHA-256 d9eed2400f148443…

SUSPICIOUS

PDF

49.3 KB Created: 2021-06-03 10:55:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9fd723ed5b1eeaae3265eba2f21b6e41 SHA-1: 6ded3d7c25b845181449651b1cdb1af7f561eb03 SHA-256: d9eed2400f14844374a99cebf1e5da034a2813a4507791a70e4ab592f840d7d4
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs, including one pointing to a "free-spin-link-game-hack", suggesting a lure for users to download potentially malicious content. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of external URIs and the document's deceptive content indicate an attempt to trick users into downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/free-spin-link-game-hack PDF link annotation
    • http://katalog.gemalibrary.net/repository/give-me-robux-now_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/how-to-get-free-robux-without-verifying_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/how-to-hack-someones-account-on-roblox_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/coin-master-free-soins_GM406889139.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/free-robux-without-verification-2021_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/coin-master-hacks-reddit_GM406889139.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/roblox-sued_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/free-spins-coin-master-links-2021_GM406889139.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/free-robux-no-verification-no-download_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/coin-master-free-link-spin_GM406889139.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/free-robux-by-watching-ads_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/best-tricks-co-robux_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/free-robux-now_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/how-to-hack-roblox-accounts-for-robux_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/minecraft-gun-mod-download-free_GM479516143.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/how-to-get-free-robux-gift-cards_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/claim-free-robux_GM431946152.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/coin-master-free-spin-ml_GM406889139.pdfIn PDF document text
    • http://katalog.gemalibrary.net/repository/coin-master-free-spins-link-blogspot-april-2021_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000523a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x523A 27812 bytes
SHA-256: d7488f81e40882b476391b3265b1bd1d15f3646ef68d661b1fd771912995acdc
font_01_sfnt_off000092a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92A1 4056 bytes
SHA-256: a645476b19c355b2d512694e4de02549670de569a66445ece8c14f7213528aec
font_02_sfnt_off0000a06f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA06F 17580 bytes
SHA-256: 3affe4290d3c586f8abc652f24a5d7e7753726cbbd633ecc9a81f23a594e743c

Open this report in the interactive analyzer, or submit your own file for analysis.