PDF static analysis report

Static analysis result for SHA-256 3d088ea0a1c8b4df…

SUSPICIOUS

PDF

42.0 KB Created: 2021-05-14 09:23:56 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 319e2ff792c9eae0c8007472756bcaa6 SHA-1: c92dd6b20bb58190bebcdf78b22f684dbd80ea13 SHA-256: 3d088ea0a1c8b4df4e485f6998c624bd3df99de319cb0e383ead88bf538471ef
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs and a primary URL that strongly suggest a lure for downloading game-related cheats or hacks, such as 'Robux'. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of numerous suspicious URLs and the document's theme indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-2021-game-hack PDF link annotation
    • https://www.essentracomponents.com.my/images/roblox-fun-com-robux_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/blox-supply-free-robux_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/apk-hack-coin-master_GM406889139.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/minecraft_GM479516143.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/coin-master-free-coin-and-spin-app_GM406889139.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/coin-master-hack-apk-2021_GM406889139.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/free-robux-com-roblox_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/free-robux-kid-friendly_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/get-free-lives-on-coin-master_GM406889139.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/synapse-roblox-free_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/2021-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/apps-for-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/roblox-account-hacker-tool_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/how-to-hack-someones-roblox-account_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/free-spins-coin-master-daily_GM406889139.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/how-to-hack-people-on-roblox_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/free-robux-just-enter-username_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/roblox-hacks-and-cheats_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/free-robux-no-human-verification-generator_GM431946152.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/coin-master-hacks-for-pet-food_GM406889139.pdfIn PDF document text
    • https://robuxhaxs.comIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000476c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x476C 25216 bytes
SHA-256: 397f5eaf44ee483fc140ff546ce817a855682543b031ba3af2bddf3ce010d23a
font_01_sfnt_off00008196.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8196 18252 bytes
SHA-256: f22572533f4e8da48e03a48f0d29ce3544a01a0bd2cb3d9374f1b8b189e2707b