PDF static analysis report

Static analysis result for SHA-256 1a939a8a4a68bae4…

SUSPICIOUS

PDF

36.4 KB Created: 2021-06-21 04:48:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 7facb6f61bb43aeeff7cb838892ea6ab SHA-1: 671db5c55031356d98269e9b832f62ae3b1bae61 SHA-256: 1a939a8a4a68bae401a48a7e992376bf0b49a23d5dce5b5489ba45f36bbad26c
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and text that promote a 'free Robux quiz game hack', directly linking to a suspicious URL. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of embedded URLs and the lure of free in-game currency suggest an attempt to trick users into downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-quiz-game-hack PDF link annotation
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/60-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/daily-free-spin-link-for-coin-master_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/free-executor-roblox_GM431946152.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/how-do-you-get-free-roblox_GM431946152.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/free-spin-link-coin-master-today_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/what-do-roblox-points-do_GM431946152.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/ho-to-get-free-robux-in-roblox_GM431946152.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/free-roblox-hair-boy_GM431946152.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/is-minecraft-free-on-pc_GM479516143.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/coin-master-hack-link_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/minecraft-bedrock-free_GM479516143.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/tiktok-free-fire_GM835599320.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/hack-coin-master-download-ios_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/coin-master-mod-apk-hack_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/free-spins-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/coin-master-hack-ios-cydia_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/free-robux-microsoft_GM431946152.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/free-coins-for-coin-master_GM406889139.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/minecraft-realms-free_GM479516143.pdfIn PDF document text
    • https://www.lakenheath.suffolk.sch.uk/admin/ckfinder/userfiles/files/how-to-get-minecraft-for-free-on-iphone_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34DF 23196 bytes
SHA-256: 221ad9c3013b8c81a523bdc46c900a362d580f62aaa9fdcaec8d4692a67d6f74
font_01_sfnt_off0000690e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x690E 19076 bytes
SHA-256: 8797e81f1a1b9c88ca7501f7bf2e888c306881f0a6af21e01c414030d98b98eb

Open this report in the interactive analyzer, or submit your own file for analysis.