PDF static analysis report

Static analysis result for SHA-256 2f2bc3209b266c4f…

SUSPICIOUS

PDF

43.4 KB Created: 2021-05-14 22:31:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 5790d3e50ead0f6580546f42d765a4c1 SHA-1: 507d7a56db62d09dc9719d1e4539a8cb92227613 SHA-256: 2f2bc3209b266c4f9a36efff5c4b04d60c5cd8dcc88d28b681ef9ae2c04586b2
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs and a heuristic firing for an external URI, all pointing to sites offering 'Robux Hacks' or 'Coin Master' cheats. The ML classifier strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of numerous links suggests an attempt to redirect the user to a malicious download or phishing page, likely as part of a social engineering campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-hacks-2021-game-hack PDF link annotation
    • http://aeridefense.com/image/data/files/how-to-get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/websites-for-robux_GM431946152.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/daily-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-daily-free-spin-and-coin_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/free-robux-no-human-verification-no-survey_GM431946152.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/wwwcoin-master-hack-game-download_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/robux-games_GM431946152.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-free-coins-and-spins-hack_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/get-free-robux-no-human-verification_GM431946152.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-free-spins-2021-hack_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-free-2021-spin-link_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-free-spins-link-blogspot_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/113-hacked-client_GM479516143.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-hack-pc_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-link-app_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/hack-coin-master-ios-download_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/free-spin-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/get-me-robux-for-free_GM431946152.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/mcpe-116_GM479516143.pdfIn PDF document text
    • http://aeridefense.com/image/data/files/coin-master-hack-software-download_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000049ae.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x49AE 27124 bytes
SHA-256: df5b21ca13a0c348feb2b5402ba4931a72ae534359968ba5e55e52737ce5b6ea
font_01_sfnt_off0000860c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x860C 18648 bytes
SHA-256: 03ab0df94635c5ebeb05191dd2fda9aa410ed650044dc459735f8f7cc99ee4ee

Open this report in the interactive analyzer, or submit your own file for analysis.