PDF static analysis report

Static analysis result for SHA-256 2236f1015d015712…

SUSPICIOUS

PDF

47.4 KB Created: 2021-05-17 23:35:34 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f47c2915c08f1bf6c31c100a1c1d963b SHA-1: 747515789ea2988d00abb87e81b8af4e9c6e3cdc SHA-256: 2236f1015d015712b790eed8cca824bd8c14d9e274234a9235fdbe9fc8c1652f
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains a prominent link to a URL promising free Robux, a common lure for scams. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the lure suggest an attempt to redirect users to potentially malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-get-free-robux-without-verification-or-surveys-game-hack PDF link annotation
    • https://zszolesno.pl/images/minecraft-free-minecraft_GM479516143.pdfIn PDF document text
    • https://zszolesno.pl/images/get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/coin-master-download_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/can-i-get-robux-for-free_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/free-spins-coin-master-no-verification_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/coin-master-links-free-spins_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/hack-coin-master-apk-2021_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/bloxland-earn-free-robux_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/free-robux-hack_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/free-robux-not-fake_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/coin-master-free-spins-and-coins-2021_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/how-do-i-get-free-spins-in-coin-master_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/free-robux-without-human-verification-real_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/how-to-get-free-items-on-roblox_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/free-robux-with-no-survey_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/coin-master-apk-free-download_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/get-free-robux-generator_GM431946152.pdfIn PDF document text
    • https://zszolesno.pl/images/how-to-get-free-daily-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/como-sacar-buen-puntaje-en-juego-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • https://zszolesno.pl/images/coin-master-hack-spin-generator-tool_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004a31.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4A31 27756 bytes
SHA-256: 6109c8df0e190cdca460cd7338d6d76be090a7466fd9e36704ac8f4d4f458894
font_01_sfnt_off0000898f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x898F 2844 bytes
SHA-256: baad2f3f6808f4af03fa9398e38c580c8d846f7f773a947d8cc1f39b2753d31a
font_02_sfnt_off00009350.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9350 19424 bytes
SHA-256: 30551668946d9b3d80fdd5a427c07e5f2c52faec585ae3c44dbbbd4d67cc7463

Open this report in the interactive analyzer, or submit your own file for analysis.