PDF static analysis report

Static analysis result for SHA-256 43603aedd03f475a…

SUSPICIOUS

PDF

32.4 KB Created: 2021-07-19 22:20:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 8c931e97d885a23d14b3325cbc22f3c2 SHA-1: 11ef4b9e4b7b81f12defe844f5f53e76f6856321 SHA-256: 43603aedd03f475ac1213912cfdae188725bb8924c0621f6dd2bf02655d62217
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and text that lure users with promises of free game currency (Robux) and hacks, directing them to download files. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent. The presence of multiple game-related lures suggests a social engineering tactic to trick users into downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9900

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-robux-generator-no-human-verification-2021-game-hack PDF link annotation
    • http://sv-nahetal.de/images/i-got-hacked-on-roblox_GM431946152.pdfIn PDF document text
    • http://sv-nahetal.de/images/minecraft-login-free_GM479516143.pdfIn PDF document text
    • http://sv-nahetal.de/images/coin-master-free-coins_GM406889139.pdfIn PDF document text
    • http://sv-nahetal.de/images/how-to-get-free-robux-easy-no-download_GM431946152.pdfIn PDF document text
    • http://sv-nahetal.de/images/free-robux-games-that-actually-work-2021_GM431946152.pdfIn PDF document text
    • http://sv-nahetal.de/images/minecraft-server-hacks_GM479516143.pdfIn PDF document text
    • http://sv-nahetal.de/images/how-to-get-free-robux-no-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://sv-nahetal.de/images/daily-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://sv-nahetal.de/images/is-minecraft-free-on-ps4_GM479516143.pdfIn PDF document text
    • http://sv-nahetal.de/images/minecraft-hacked-client_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000282a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x282A 21948 bytes
SHA-256: 97fdfe823d2768dcf11c06849948ea151947fc08d79f61058dfda13a5177afa1
font_01_sfnt_off000058dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58DC 19448 bytes
SHA-256: c4f235c6325a062dfb1dc9d53c980481f8635b4baeb4de16fff816f4c5634972

Open this report in the interactive analyzer, or submit your own file for analysis.