PDF static analysis report

Static analysis result for SHA-256 404aabbaada5250d…

SUSPICIOUS

PDF

33.7 KB Created: 2021-06-27 20:41:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 98aaaf01f041705f3a15c0d4598d566b SHA-1: 1a4e6c273e230603c75ccddf232b8075fff10c9a SHA-256: 404aabbaada5250df6a6af489d1c56fc110ca7e5669e4f3d69e89a15f18a59ed
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous URLs related to game hacking and cheats, indicating a social engineering lure. The ML classifier flagged this PDF with high confidence, suggesting malicious intent. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the content strongly suggest the document is designed to trick users into downloading malware or visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-hack-roblox-prison-life-2.0-game-hack PDF link annotation
    • http://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/hacker-escape-prison-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/how-to-cheat-in-roblox-eep-city-starball_GM431946152.pdfIn PDF document text
    • https://www.elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/hacks-para-roblox-2021-noviembre_GM431946152.pdfIn PDF document text
    • http://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/how-to-hack-and-get-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-working-with-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/is-there-a-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/free-robux-no-verification-or-grantor-trust_GM431946152.pdfIn PDF document text
    • https://www.elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/how-to-speed-hack-granny-roblox_GM431946152.pdfIn PDF document text
    • http://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/how-to-make-a-roblox-ad-for-free_GM431946152.pdfIn PDF document text
    • https://www.elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/best-free-minecraft-server-hosting_GM479516143.pdfIn PDF document text
    • http://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/is-minecraft-free-on-xbox-one_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/coin-master-free-spins-hack_GM406889139.pdfIn PDF document text
    • https://www.elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/coin-master-fan-page-free-spins_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-prison-life-v2-02_GM431946152.pdfIn PDF document text
    • https://www.elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/roblox-prison-life-hack_GM431946152.pdfIn PDF document text
    • https://www.elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/roblox-cheat-codes-for-bee-swarm_GM431946152.pdfIn PDF document text
    • https://www.elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-without-human-verification-2021_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/roblox-free-robux-hack-easy_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/roblox-group-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn2tala.sch.id/__statics/gudangsoal/files/hello-neighbor-free-play-in-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C24 22244 bytes
SHA-256: 1c56fae7ea42c0d613247e34668e74302cc6abceb0bef09acc2e1009978ebff7
font_01_sfnt_off00005d7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D7C 19456 bytes
SHA-256: 3d8ad1934a39250536877ef83b36d1cf9a66d739d796ceecfff48d94d599cb0b

Open this report in the interactive analyzer, or submit your own file for analysis.