PDF static analysis report

Static analysis result for SHA-256 40f1e7a943838158…

SUSPICIOUS

PDF

35.1 KB Created: 2021-06-25 19:20:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 575b6f913be7abda567b60c4e4019732 SHA-1: 1772d8ab46c2bf6f1b8357ddbd022e055df9b0c7 SHA-256: 40f1e7a9438381583bd04f196530d6da2d48d485fa2edd9aeeb04bb4e660a707
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains numerous embedded URLs and a prominent external URI pointing to sites offering free in-game items, a common lure for phishing or malware distribution. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent. While no scripts were explicitly extracted, the presence of numerous links and the ML detection suggest the document is designed to redirect users to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-get-free-robux-roblox-generator-game-hack PDF link annotation
    • http://shoruq.sch.ae/userfiles/files/free-roblox-avatar-ideas_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/how-to-get-free-gamepasses-on-roblox_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/coin-master-free-spins-link-app-download_GM406889139.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/coin-master-spin-hack-no-human-verification_GM406889139.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/how-to-get-free-robux-no-scam_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/pokemon-go-free-60fps_GM1094591345.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-robux-without-doing-anything_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/how-to-create-group-in-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-coin-master-gifts_GM406889139.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/is-pokemon-go-fest-free_GM1094591345.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/groups-give-free-roblox_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/how-to-get-free-robux-instantly_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-roblox-accounts-with-robux_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-coin-master-spins-2021_GM406889139.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-spins-coin-master-links_GM406889139.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/how-to-download-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-spins-coin-master-2021-today_GM406889139.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-robux-apk-no-human-verification_GM431946152.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/free-minecraft-client_GM479516143.pdfIn PDF document text
    • http://shoruq.sch.ae/userfiles/files/easy-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003230.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3230 22452 bytes
SHA-256: e3bb589973edecc3d97d956c61b826383beb3d75c091cc01d7753b02bd991630
font_01_sfnt_off0000644a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x644A 19056 bytes
SHA-256: 410ef0d4bf04f80377e14ed5cc84ef3342a5e37e901aa162a3be68664eba0954

Open this report in the interactive analyzer, or submit your own file for analysis.