PDF static analysis report

Static analysis result for SHA-256 e57d63a362ab124e…

SUSPICIOUS

PDF

34.8 KB Created: 2021-06-26 09:18:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9aa053a299752e4a6d1267fe33e41f25 SHA-1: 112a75a7f283ae5808930093c24b7af308bb05c7 SHA-256: e57d63a362ab124e94e886188c9344cf66065f6e26a7d3e06827c8da3be9aebc
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs, including one pointing to 'netcdn.co', which are likely intended to redirect users to download malicious payloads or engage in phishing. The ML classifier strongly flagged this PDF as malicious, and the presence of download-related lures reinforces the suspicious nature of the document. No scripts were extracted, but the overall pattern suggests a downloader or phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-font-generator-game-hack PDF link annotation
    • http://perpustakaan.yudharta.ac.id/etj/repository/freerobuxhack-us-2021_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/roblox-egg-hunt-2021-free-to-take_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/oprewards-robux_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/how-to-download-minecraft-for-free-on-android_GM479516143.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/coin-master-free-spins-today-39_GM406889139.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/coin-master-game-hack-app-download_GM406889139.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/coin-master-mod-version-free-download-v344_GM406889139.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/robux-free-online_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/coin-master-hacks-for-spins_GM406889139.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/dominus-roblox-free_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/roblox-group-free-robux_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/freerobloxde-hack_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/dax-she-cheated-roblox-id_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/roblox-hack-tool-cheat-hacker_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/mcpe-com_GM479516143.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/group-gives-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/free-robux-not-patched_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/united-gaming-net-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/how-do-people-get-hacked-followers-on-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.yudharta.ac.id/etj/repository/roblox-r45-rig-hack_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00002fff.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2FFF 22992 bytes
SHA-256: 165256fdffbb4924dd625401cd1d9dbfb41d7bd1382b2bb9a521a816b6ee807d
font_01_sfnt_off000063d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63D0 18752 bytes
SHA-256: a244707a90709de5778364171d74d51263c7c06c2c122b77880c48f1d0c2b454

Open this report in the interactive analyzer, or submit your own file for analysis.