PDF static analysis report

Static analysis result for SHA-256 39139a00693640eb…

SUSPICIOUS

PDF

48.2 KB Created: 2021-04-30 13:05:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: f367dd100a5750c90638073b99d83448 SHA-1: fb7f374827a21b1b56f32f7aaa188c26641f1693 SHA-256: 39139a00693640eb7aca9d7515d73d550d2148f089e3b7f0f24751cc4942248f
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains an embedded URI pointing to a website offering a 'Roblox Hack'. The ML classifier also flagged this PDF as malicious. While no scripts were directly extracted, the presence of external links and the document's theme suggest an attempt to trick users into downloading potentially malicious software disguised as a game hack. The document's content and heuristics indicate a phishing or social engineering attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9764

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/diamond-roblox-hack-jailbreak-game-hack PDF link annotation
    • https://fridaytravelnepal.com/userfiles/files/earn-gg-free-robux.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/alt-hack-roblox.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/redeem-code-roblox-free-robux-2021.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/fps-roblox-hacks.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/how-to-get-a-robux-gift-card-for-free.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/inject-hack-app-roblox.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/hack-richest-roblox-account-deleted.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/hack-para-roblox-final-stand.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-free-download-pc-windows-8.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-model-purchase-request-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000043d7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x43D7 25776 bytes
SHA-256: 92e280e60235a3a64201ddb68c8dacd897679459cf8a3f71dd8a7467058ce645
font_01_sfnt_off00007d86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D86 11440 bytes
SHA-256: 154d59d1680f2d1e38ccb783d6997f344290d121007e51df331726de4128c12e
font_02_sfnt_off000098a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98A7 19068 bytes
SHA-256: 0a39be31d7a19b2e680c65c50e05f1a0f041c57fd271923ee6c4068ca0b40d8f

Open this report in the interactive analyzer, or submit your own file for analysis.