PDF static analysis report

Static analysis result for SHA-256 560bfc2fb85f702b…

SUSPICIOUS

PDF

48.9 KB Created: 2021-06-07 21:42:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: c9a2da8f5dc710132cd7a11975c6d3ee SHA-1: 85e5cb1eee1d2018894e3dc9c4b34b1021111327 SHA-256: 560bfc2fb85f702b445f581f1c9e81ed9c190f35e57880d47fe439923fa4e0ba
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous URLs and a document body that explicitly advertises a 'Free Robux Code Generator Tool'. The presence of multiple suspicious URLs, combined with the lure of free in-game currency, strongly suggests a phishing or scam attempt. The ML classifier also flagged this PDF as malicious, increasing confidence in its malicious intent. No scripts were extracted, but the document's content and embedded URLs point towards a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-robux-code-generator-tool-no-human-verification-game-hack PDF link annotation
    • https://kierowcyhgv.uk/images/minecraft-free-ios-2021_GM479516143.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/toolbox-for-minecraft_GM479516143.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/how-do-i-get-minecraft-for-free_GM479516143.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/free-robux-pin-codes_GM431946152.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/free-minecraft-account_GM479516143.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/roblox-army-robux_GM431946152.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/coin-spin-link_GM406889139.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/minecraft-net-free_GM479516143.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/download-hack-coin-master-apk_GM406889139.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/free-robux-no-apps_GM431946152.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/minecraft-pocket-edition-free-apk_GM479516143.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/robux-hack-free-robux_GM431946152.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/coin-master-hack-tool-ios_GM406889139.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/free-spins-on-coin-master-app_GM406889139.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/roblox-free-download_GM431946152.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/coinmaster-spin-ml-link_GM406889139.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/minecraft-mac-free_GM479516143.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/reddit-coin-master-hack_GM406889139.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/cheat-codes-for-coin-master_GM406889139.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/coin-master-hack-ios-download-2021_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000529a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x529A 27216 bytes
SHA-256: f0f2f0ee337568eaa205489cd0c2c50dfb96cab2dd8da04f37522685bdb77796
font_01_sfnt_off0000903c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x903C 2844 bytes
SHA-256: baad2f3f6808f4af03fa9398e38c580c8d846f7f773a947d8cc1f39b2753d31a
font_02_sfnt_off000099fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x99FE 19108 bytes
SHA-256: 2876064ae1a346940ced6c47143a7ad0ea3d1832a318498e83445ed9fde12feb

Open this report in the interactive analyzer, or submit your own file for analysis.