PDF static analysis report

Static analysis result for SHA-256 e4c3d5a4f97187cf…

SUSPICIOUS

PDF

44.9 KB Created: 2021-05-15 03:27:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 78b71367b2fcfbced79894281a5783ee SHA-1: 28aa5af6428de0105a2f8cfaaa157ed861ec680d SHA-256: e4c3d5a4f97187cf6d34194ab8c5a38901c935d38963671ed6e5f192555ef6dc
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains embedded URLs and a visual download button lure, suggesting it is designed to trick users into downloading malicious content. The ML classifier also flagged this PDF as malicious with high confidence. The primary URL identified is https://netcdn.xyz/app/479516143/minecraft-free-edition-game-hack, which is likely the intended download destination for the fake game hack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9632

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-free-edition-game-hack PDF link annotation
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/minecraft-pvp-hacks_GM479516143.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/coin-master-mod-version-free-download_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/coin-master-100-spin_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/lots-of-robux_GM431946152.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/coin-master-daily-free-spins-hack_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/hack-free-spin-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/free-minecraft-client_GM479516143.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/coin-master-hack-trick-2021_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/coin-master-download-hack_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/free-coin-and-spin-for-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/www-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/coin-master-hack-no-human-verification-2021_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/free-coin-master-spins-and-coins_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/how-to-get-minecraft-for-free-on-android_GM479516143.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/free-robux-hack-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/coin-master-online-hack-tool_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/free-robux-without-verification_GM431946152.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/get-free-robux-no-human-verification_GM431946152.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/daily-free-spins-coin-master-heaven_GM406889139.pdfIn PDF document text
    • https://elearning.manicp.sch.id/__statics/gudangsoal/files/public-enemy-sun-prairie-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ca8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4CA8 24552 bytes
SHA-256: 150db1794711467c7f30737aaa6127f673f41ee66b95dab80a462baec8f2ca3b
font_01_sfnt_off00008442.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8442 2896 bytes
SHA-256: d7ce0ce59bb3e08a28f605dca2e7120dc71065ebe1e0a63261ed74b9d00267d8
font_02_sfnt_off00008e4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E4A 17884 bytes
SHA-256: b79fa13a8014c541ecaa50cf2ea2342c8b7987f05c534eedd8f1cc9ff0cdeb29

Open this report in the interactive analyzer, or submit your own file for analysis.