PDF static analysis report

Static analysis result for SHA-256 fb2521cdaf5d0d93…

SUSPICIOUS

PDF

39.0 KB Created: 2021-05-24 04:26:36 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 27aec67c2bf8c8de089d4a61c470812d SHA-1: deb594d8f255dacac01910a9230ba7fecf1aea31 SHA-256: fb2521cdaf5d0d93b48cf2c6a317584789112830db277ef5576a365db4b31f19
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs pointing to websites that promise free items, such as TikTok likes or game currency, which is a common lure for phishing and scam operations. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of external URIs and the document's content strongly suggest a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8060

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/835599320/get-free-likes-on-tiktok-game-hack PDF link annotation
    • https://dribledasortegaucho.com.br/uploads/files/free-redeem-code-for-coin-master_GM406889139.pdfIn PDF document text
    • https://dribledasortegaucho.com.br/uploads/files/easy-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://dribledasortegaucho.com.br/uploads/files/free-minecraft-account_GM479516143.pdfIn PDF document text
    • https://dribledasortegaucho.com.br/uploads/files/robux-com-free_GM431946152.pdfIn PDF document text
    • https://dribledasortegaucho.com.br/uploads/files/how-to-get-free-robux-easy-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000033a9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x33A9 26772 bytes
SHA-256: 2feab4d18d7418a420685e2546a2191b5718c95c0748183ee68cd034ceb49a1e
font_01_sfnt_off00006f65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F65 2940 bytes
SHA-256: eb230542719c96b42e3fd8bb01e35f13ebd5f02629049da3a58e7fd7607bf48a
font_02_sfnt_off00007975.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7975 17456 bytes
SHA-256: 782ce757928ab8849be8d7d6232199a595fd3f8ee03de5cb15c7b9ee803e6cfd

Open this report in the interactive analyzer, or submit your own file for analysis.