PDF static analysis report

Static analysis result for SHA-256 0c42519460b2800f…

SUSPICIOUS

PDF

41.8 KB Created: 2021-05-17 05:02:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 220ec5890287c1efae1488a743622acf SHA-1: 3c7f3c83585faeef4e38894df36226bd89d31d66 SHA-256: 0c42519460b2800f8522fd7821a37edf6ae21e8e801f8bc5ae81c9ed26caff4c
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a lure related to Roblox hacking and embeds multiple URLs, one of which is directly referenced in the document body. The ML classifier strongly indicates maliciousness, and the presence of external URIs suggests the document is designed to redirect the user to a potentially malicious site for further action, likely a payload download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/i-got-hacked-on-roblox-game-hack PDF link annotation
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/rbx-website_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/coin-master-free-spin-link-today-2021_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/coinmasterfreespinlink_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/coin-master-free-spins-link-today-hack_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/how-to-get-free-robux-easy_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/how-to-hack-coin-master-computer_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/static-moonactive-net_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/minecraft-ps3-free-download_GM479516143.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/free-robux-generator-without-verification_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/roblox-bux-free_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/how-to-win-free-robux_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/free-robux-generator-for-roblox-2021_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/free-robux-on-phone_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/www-coinmaster-com_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/coin-master-free-online-game_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/free-minecraft-java-account_GM479516143.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/make-free-robux_GM431946152.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/coin-master-hack-tool-india_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/2021-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://cpsad.adturekorea.co.kr/newboard/_upload/userfiles/files/coin-master-spin-link-free_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000045fe.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x45FE 25256 bytes
SHA-256: 4a347631ba67597ac910e1453d76797efe29dd6da89d2d505add1a09cffad8e9
font_01_sfnt_off00008028.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8028 18460 bytes
SHA-256: a8a49c36ef4b2531a5f792820ad3efe99a39c3e474aae1f279e7d577006455a1

Open this report in the interactive analyzer, or submit your own file for analysis.