PDF static analysis report

Static analysis result for SHA-256 1dc98cd216fd0f02…

SUSPICIOUS

PDF

40.8 KB Created: 2021-04-03 17:00:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: b4cbb6f76671ccddd42a41a5054e011b SHA-1: 39e50ecefa7edbc292267c28591f96b16ccc62a1 SHA-256: 1dc98cd216fd0f02f9e76985c1f8d18e7b95c7c3f8263d195fc59ba069d14310
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs, with the primary one being http://gaminggenerator.org/app/431946152/roblox-cheat-engine-2021, suggesting a lure for downloading potentially malicious software disguised as a cheat engine. The ML classifier also flagged this PDF as malicious with a high probability. While no scripts were explicitly extracted, the presence of embedded URLs and the document's theme point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9787

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-cheat-engine-2021 PDF link annotation
    • https://www.sitiwebjoomla.it/images/rc7-roblox-download-free.pdf%0AIn PDF document text
    • http://echosvoix.ch/images/how-to-get-free-robux-glitch-2021.pdf%0AIn PDF document text
    • http://www.anies.eu/images/roblox-free-shirt-not-model.pdf%0AIn PDF document text
    • http://bkd1.balikpapan.go.id/images/roblox-jailbreak-hack-noclip.pdf%0AIn PDF document text
    • http://www.exikom.com.ua/images/to-get-robux-for-free.pdf%0AIn PDF document text
    • http://www.occquimica.com.br/images/como-ser-hacker-en-roblox-pc.pdf%0AIn PDF document text
    • http://uptodate.az/images/roblox-free-robux-bot-v3rmillion.pdf%0AIn PDF document text
    • http://www.nielsen2u.dk/images/roblox-treasure-wuest-how-to-get-effects-for-free.pdf%0AIn PDF document text
    • http://www.actae.gr/images/roblox-free-robux-no-human-verification-2021.pdf%0AIn PDF document text
    • http://www.fluidtech.hu/images/roblox-console-robux-hack.pdf%0AIn PDF document text
    • http://www.eurologistiki.gr/images/how-to-hack-your-robux-on-roblox.pdf%0AIn PDF document text
    • https://www.tsdb.com.au/images/drpoppa-anti-cheat-roblox.pdf%0AIn PDF document text
    • https://technospektr.com.ua/images/roblox-hack-menus.pdf%0AIn PDF document text
    • http://nevesomost.by/images/get-free-robux-gift-cards.pdf%0AIn PDF document text
    • http://www.nielsen2u.dk/images/free-promo-codes-roblox-2021-december.pdf%0AIn PDF document text
    • https://www.foodsafety.cz/images/how-to-change-your-roblox-username-for-free-no-email.pdf%0AIn PDF document text
    • http://www.vktzunami.cz/images/hackear-roblox-cheat-engine.pdf%0AIn PDF document text
    • http://portal.crfsp.org.br/images/how-to-get-free-robux-on-ios-2021.pdf%0AIn PDF document text
    • http://www.torvet11.dk/images/stickmasterluke-free-robux-obby.pdf%0AIn PDF document text
    • http://dos.most.gov.la/images/roblox-rs-cheat.pdf%0AIn PDF document text
    • http://dos.most.gov.la/images/how-do-you-get-free-roblox-robux.pdf%0AIn PDF document text
    • http://zarinnameh.ir/images/roblox-cheat-dungeon-quest-fr.pdf%0AIn PDF document text
    • http://kids-academy.pl/images/free-account-roblox-2021-obc.pdf%0AIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/dupe-tool-hack-roblox.pdf%0AIn PDF document text
    • https://kimolos-link.gr/images/roblox-xbox-free-packages.pdf%0AIn PDF document text
    • http://cosver.eu/images/roblox-pc-hack-2021.pdf%0AIn PDF document text
    • https://www.foodsafety.cz/images/tsarsploit-hack-roblox.pdf%0AIn PDF document text
    • https://ballaratcaravans.com.au/images/completely-free-robux-hack.pdf%0AIn PDF document text
    • http://domaizdereva24.ru/images/hack-roblox-users.pdf%0AIn PDF document text
    • http://www.cbgp.upm.es/images/roblox-free-black-wings.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003cd4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3CD4 28672 bytes
SHA-256: 3aa1c30b277652a18139d451c5ed88d84a239bbe956f9dbb253aa50eea03728c
font_01_sfnt_off00007c7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C7F 18328 bytes
SHA-256: ad026bd045720e24ecd854fb6d915289ab89b37e92a6ab883c5365049d23a88a

Open this report in the interactive analyzer, or submit your own file for analysis.