PDF static analysis report

Static analysis result for SHA-256 5f7c57c0dd7ba191…

SUSPICIOUS

PDF

33.5 KB Created: 2021-07-03 15:41:40 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: ac987bd7f7a768d82687a5cdc5411538 SHA-1: 22b3177fc0178765f7c6d9497e796b3b5c70f2df SHA-256: 5f7c57c0dd7ba191e4a583989cf63385a327fb8f2b1e5ba768de82e7e07771f2
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains lures related to 'free promo codes for Roblox 2021' and a call-to-action button, aiming to trick users into clicking malicious links. The ML classifier strongly flagged this PDF as malicious, and an external URI was detected pointing to a suspicious domain. While no scripts were explicitly extracted, the presence of embedded URLs and the document's theme suggest an attempt to redirect users to download further malicious content or exploit kits.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-promo-codes-for-roblox-2021-game-hack PDF link annotation
    • https://library.institutpendidikan.ac.id/repository/how-to-hack-roblox-accounts-2021-unpatched_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/bear-face-mask-free-roblox_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/how-do-you-get-free-robux-on-ipad_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/commande-lua-roblox-cheat_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/hack-script-roblox-game-servers-scripts_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/free-robux-2021-december_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/roblox-army-free-robux_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/minecraft-server-hacks_GM479516143.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/roblox-robux-hack-without-survey_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/how-to-hack-breaking-point-roblox-2021_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/hack-para-teletransportarse-en-roblox_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/wahoogaming-co-free-robux_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/coin-master-map_GM406889139.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/roblox-hair-for-free_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/free-roblox-alternatives_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/mcpe-master-free-coins_GM406889139.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/minecraft-nintendo-switch-digital-code-free_GM479516143.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/free-robux-now_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/mobilehacks4u-free-roblox_GM431946152.pdfIn PDF document text
    • https://library.institutpendidikan.ac.id/repository/free-robux-generator-2021-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002bbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BBC 21932 bytes
SHA-256: b5dcf2c8937bc387fc9ff30bfcf09580a23d30894ccb49e82d6d8a966ee55861
font_01_sfnt_off00005c43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5C43 19640 bytes
SHA-256: 563683e195a0f9c5774dff93a1ee8ffa5b9fae5e1b7336e1c9c22065f2ab4a19

Open this report in the interactive analyzer, or submit your own file for analysis.