PDF static analysis report

Static analysis result for SHA-256 2b68f2fca35ad9d6…

SUSPICIOUS

PDF

24.2 KB Created: 2021-06-17 16:19:36 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 2f423a8bbdaaf5cdaf66a6f8c45fd016 SHA-1: f17aa8777786db5f166535607d65aae803bb3e65 SHA-256: 2b68f2fca35ad9d697b7bc15623b1094c38571491db455de718c7942e0c6e2ae
34 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs, including one pointing to 'netcdn.co', which is flagged as malicious. The document body text explicitly mentions "Free Roblox Render" and "Robux Generator", indicating a lure for users interested in game-related exploits. The ML classifier also flagged this PDF with high confidence. No scripts were extracted, but the presence of malicious URLs suggests the document is intended to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-render-game-hack PDF link annotation
    • http://lib.untad.ac.id//repository/how-to-get-free-robux-inspect_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/roblox-dbor-hack_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/free-roblox-groups_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/coin-master-online-hack_GM406889139.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/robux-free-online_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id//repository/roblox-free-roblox_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/fart-attack-roblox-hack_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/cpbildco-robux_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/free-roblox-gear_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/coin-master-free-coins-and-spins-daily_GM406889139.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/free-robux-scammers-to-troll_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/free-robux-codes-2021_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/coin-master-hack-version-2021-download_GM406889139.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/coin-master-free_GM406889139.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/optifine-minecraft-pe_GM479516143.pdfIn PDF document text
    • http://lib.untad.ac.id//repository/free-robux-promo-codes-2021_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id//repository/coin-master-hack-download-ios_GM406889139.pdfIn PDF document text
    • http://lib.untad.ac.id/repository/hack-of-2021-roblox_GM431946152.pdfIn PDF document text
    • http://lib.untad.ac.id//repository/how-to-hack-coin-master-game-2021_GM406889139.pdfIn PDF document text
    • http://lib.untad.ac.id//repository/coin-master-free-spins-coins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002932.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2932 21144 bytes
SHA-256: 214048a64ed3955fd2255b8bd10ac8b2385ae23f8e99c90c3ff6cf8ab15c64e9

Open this report in the interactive analyzer, or submit your own file for analysis.