PDF static analysis report

Static analysis result for SHA-256 4eb2aee29bd09ccc…

SUSPICIOUS

PDF

37.0 KB Created: 2021-06-26 10:28:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 6523ff8f5315874838b9839c24eb0793 SHA-1: 040750c061193242c0b4128d9884d2c91a2030da SHA-256: 4eb2aee29bd09ccc914c36fd1e758233bf05e2e6590b2eea2c816bbb1812bca3
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs, including one pointing to 'netcdn.co' which is associated with free Robux offers. The ML classifier strongly flagged this PDF as malicious. The presence of these links suggests a phishing or scam attempt to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/earn-free-robux-on-roblox-game-hack PDF link annotation
    • http://zercalo.org/images/free-hoverboard-roblox-mad-city_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-hack-roblox-big-brother_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/free-robux-generator-no-verification-2021_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-add-robux-to-used-roblox-card-cheat_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/free-coin-master-game_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/free-robux-without-an-app_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-a-star-code-roblox-hack_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/free-robux-no-human-verification-or-survey-or-download-2021_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-free-robux-by-robux-king_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-unlimited-robux_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-free-spins-link-2021-hack_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/free-robux-codes-no-verification_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/coin-master-free-spins-2021_GM406889139.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-minecoins-in-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://zercalo.org/images/how-to-hack-for-money-in-roblox-jailbreak_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/get-free-robux-com_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-get-more-robux-for-free_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/how-to-cheat-in-robux-2021_GM431946152.pdfIn PDF document text
    • http://zercalo.org/images/roblox-whatever-floats-your-boat-money-hack_GM431946152.pdfIn PDF document text
    • https://www.roblox.com/.IIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003930.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3930 23104 bytes
SHA-256: 1635b9368b9c3353025c2ab01bfc0403f0c625319157e9ddb0af34ac8ed91fe2
font_01_sfnt_off00006cbf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6CBF 18788 bytes
SHA-256: af3555bc1f517b69886570aade67a9791766090da4e1e41d0d69d2926e00b478

Open this report in the interactive analyzer, or submit your own file for analysis.