PDF static analysis report

Static analysis result for SHA-256 4a4f0f4a3ec1bb75…

SUSPICIOUS

PDF

36.1 KB Created: 2021-06-28 03:06:40 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 38839ebe098628413a630283380a0d31 SHA-1: 28719ad61040df72748b1b5beefae1bf541f0eec SHA-256: 4a4f0f4a3ec1bb75262b920d5eecd9fb51b18f21082d5b66f06e6698564f22be
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and text that strongly suggest a lure for downloading game cheats or hacks, specifically for Roblox. The ML classifier also flagged this PDF as malicious with high confidence. The presence of external URIs and the overall theme point towards a phishing or social engineering attack aimed at tricking users into downloading potentially harmful software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-toys-free-code-generator-game-hack PDF link annotation
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/hack-para-volar-en-roblox_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/minecraft-hacked-client-download_GM479516143.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/free-coins-coin-master-ios_GM406889139.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/how-to-get-free-stuff-on-roblox_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/daily-coin-master-free-spin-apk_GM406889139.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/roblox-hack-codes_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/free-robux-glitch-2021_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/coin-master-free-coins-and-spins-hack_GM406889139.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/roblox-btools-press-n-script-hack_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/minecraft-windows-10-free_GM479516143.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/how-do-you-hack-minecraft_GM479516143.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/free-minecraft-account_GM479516143.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/how-to-get-minecraft-for-free-on-xbox-360_GM479516143.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/free-shields-coin-master_GM406889139.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/how-do-i-get-free-stuff-on-roblox_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/coin-master-free-spins-cheat_GM406889139.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/rbxraincom-free-robux_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/coin-master-free-spins-bit-ly_GM406889139.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/roblox-money-hack-mad-city-2021-safe_GM431946152.pdfIn PDF document text
    • https://www.decorsofacile.com/uploaded_files/userfiles/files/coin-master-hack-here_GM406889139.pdfIn PDF document text
    • https://www.roblox.com/.IIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35A5 22504 bytes
SHA-256: efd8ab3346b198df4df65b800f13f03a86ec3eaddeb34ecb3a4f443223c75ff3
font_01_sfnt_off000067ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x67EF 19108 bytes
SHA-256: 3911eb0f817bfeadef52a44de3d9ec7b87b1fd27ffc1952bc1a59c123637107a

Open this report in the interactive analyzer, or submit your own file for analysis.