PDF static analysis report

Static analysis result for SHA-256 219b45b7cb8b5c65…

SUSPICIOUS

PDF

41.4 KB Created: 2021-05-01 00:44:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 71379de9563548ab1a6517b5f46b2e5a SHA-1: b255678efe498959da6f840b1e28a07e688b1115 SHA-256: 219b45b7cb8b5c65db1c5d1cc14cd98cd131208d1e579543d7b340f17ccc2cd5
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a prominent call-to-action phrase, luring users to click on links that promise Roblox cheats and free Robux. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests an attempt to download a secondary payload. No scripts were extracted, but the document's structure and embedded links indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/zombie-rush-roblox-cheats-game-hack PDF link annotation
    • https://fridaytravelnepal.com/userfiles/files/roblox-studio-free-templates.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-robux-generator-no-virus.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/how-to-use-wifi-roblox-hack.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/inject-hack-app-roblox.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-credit-card-free.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/how-do-i-hack-roblox-account.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/earn-gg-free-robux.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/estan-hackeando-roblox-13-08-19.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-hack-robux-2021-unlimited-robux-and-tix.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/01-know-this-free-robux-secret.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004391.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4391 26108 bytes
SHA-256: dd390143c540b480c650397e07551f00bfedbee7e49fe46bee7214ecc803881e
font_01_sfnt_off00007e2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7E2F 18896 bytes
SHA-256: 4ceda664c0a3b577d3908c14ecca1aa76ab9fa13a83f558086ca46250a19bff9

Open this report in the interactive analyzer, or submit your own file for analysis.