PDF static analysis report

Static analysis result for SHA-256 4738851d8cab6b2a…

SUSPICIOUS

PDF

34.5 KB Created: 2021-06-28 18:50:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 1ea9aabc3fe4f51c5499d57235481624 SHA-1: 1201b3a3598d4d63fa99f2679d39a15711c7c78f SHA-256: 4738851d8cab6b2a8053d5e08eafcccfc1bd5ee0e3153a8717d1b71a7da6cdbc
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier strongly indicates maliciousness, and the document body contains numerous URLs advertising game hacks and cheats. One specific URL, http://netcdn.co/app/431946152/roblox-polyguns-hack-credits-game-hack, appears to be the primary lure. The presence of embedded URLs and the nature of the content suggest an attempt to trick users into downloading malware disguised as game cheats.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-polyguns-hack-credits-game-hack PDF link annotation
    • http://perpus.stikesphi.ac.id/repository/is-coin-master-free_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/free-appsfor-coin-master-daily-rewards_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/roblox-hack-scripts-pastebin_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/roblox-promo-codes-for-free-robux_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/robux-gift-card-free_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/roblox-free-robux-generator_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/how-to-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/how-do-i-earn-robux_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/village-coin_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/free-coin-master-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/coin-master-free-spins-hack_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/free-shirt-templates-on-roblox_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/8bp-hack-coin-master_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/hack-to-train-railway-roblox_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/roblox-hack-tool-free-download-no-survey-no-password_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/moonactive-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/roblox-avatar-tester_GM431946152.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/coin-master-free-daily-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/25-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://perpus.stikesphi.ac.id/repository/robloxheroxyz-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FC6 22020 bytes
SHA-256: 697f205a1f27899467c113e8369084047ea9dc1ea1c6cf5cc0e8ac7dac3da6bb
font_01_sfnt_off0000605e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x605E 19528 bytes
SHA-256: f391cd27b6b23546920a62713b17d530709e92caf494842543fbe2c26f9e1480

Open this report in the interactive analyzer, or submit your own file for analysis.