PDF static analysis report

Static analysis result for SHA-256 3677f35929ec26f7…

SUSPICIOUS

PDF

35.5 KB Created: 2021-06-23 07:41:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f0c3c2bd4938e1b6a473ed5c5faf2713 SHA-1: 8117b683d9fdadf0f074d1499377068c6146a66a SHA-256: 3677f35929ec26f79d09c996c671e4f1297bf5ddd843d553bb7bfc127872651c
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a prominent external URI pointing to a download site for game hacks. The document body text explicitly mentions 'Free Roblox Money No Verification' and 'free robux', indicating a lure for potentially unwanted or malicious software. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is designed to trick users into downloading and executing harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-money-no-verification-game-hack PDF link annotation
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/free-robux-for-free_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/blox-supply-free-robux_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/free-printable-minecraft-coloring-pages_GM479516143.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/coin-master-official-website_GM406889139.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/how-to-get-coin-master-free-spins-in-email_GM406889139.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/free-robux-no-human-verification-or-survey-2021_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/coin-master-free-spins-link-blogspot_GM406889139.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/coin-master-free-spins_GM406889139.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/free-roblox-jazwares-codes_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/how-to-get-free-money-on-roblox-jailbreak_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/how-to-get-robux_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/minecraft-redeem-code-free_GM479516143.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/how-to-play-minecraft-online-for-free_GM479516143.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/roblox-skin-free_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/get-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/100-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/free-robux-no-hack-or-cheat_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/how-to-hack-and-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/master-coin-free-spin-daily_GM406889139.pdfIn PDF document text
    • https://www.kis.ac.th/kis_international/assets/uploads/img/all/files/how-do-u-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003318.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3318 22404 bytes
SHA-256: b981171c2b4d8a2011ee4c4fa2286873155f67265e5b09fe1f1f855782753920
font_01_sfnt_off000064c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64C1 19384 bytes
SHA-256: 2841c64a175fe39fd47be62b2ea5c6f6e37110fba4ddcbc83eeef740d77384ea

Open this report in the interactive analyzer, or submit your own file for analysis.