PDF static analysis report

Static analysis result for SHA-256 260a234de5ad26f0…

SUSPICIOUS

PDF

43.6 KB Created: 2021-04-27 10:19:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 4961d8eee4578d17a3e853b8ea0a230b SHA-1: fbac69dffcfab0e704c4d2301097790bbe7c2b89 SHA-256: 260a234de5ad26f01aa43092c29957bfeddb3fddf4ca67f2ecb1fb0e1dbf0ced
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a lure for free Roblox items and includes a prominent call-to-action to access a generator. It embeds multiple URLs, one of which, https://netcdn.xyz/app/431946152/free-roblox-wallpapers-game-hack, is flagged as a potential malicious external URI. The ML classifier also strongly indicated maliciousness. While no scripts were directly extracted, the presence of embedded URLs and the nature of the lure suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9868

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-roblox-wallpapers-game-hack PDF link annotation
    • http://www.saburai.ac.id/elibrary//repository/how-to-play-a-game-that-cost-robux-free.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/bhop-hack-roblox.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/free-rich-roblox-accounts-2021.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/moon-tycoon-roblox-gives-free-robux.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-get-free-robux-legit-with-proof.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/dragon-ball-online-roblox-cheats.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-get-free-robux-urban420-network.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/roblox-frappe-hacks.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/robux-hack-no-human-verification-android.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/roblox-copy-game-hack.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00003f33.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3F33 26396 bytes
SHA-256: d388b22d94c917d3a58f912ae4f96a1e729ba121211ca9c8863ecdf4390188e4
font_01_sfnt_off00007be2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BE2 3380 bytes
SHA-256: a91a5cf6acfcf0d5e2ebc12c2b1474034bad5302098e078a7b46346115763e44
font_02_sfnt_off00008779.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8779 18552 bytes
SHA-256: 8d589030ac06515b8ef17277df6c272e951f8c3748ec40a6917a266360e6f6e9

Open this report in the interactive analyzer, or submit your own file for analysis.