PDF static analysis report

Static analysis result for SHA-256 60d9a3716ad07bc7…

SUSPICIOUS

PDF

34.9 KB Created: 2021-06-18 15:35:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 0ea616b21de3ac70ffb92ccf78fc4ba5 SHA-1: 30c63f4d2de682aabe204869071b29b22a9fdc7e SHA-256: 60d9a3716ad07bc713469a8cb6487b0722e69a8746bde1d31693750b814d3151
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a call-to-action phrase related to 'free Robux', strongly suggesting a phishing or scam lure. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of embedded URLs and the document's content indicate an attempt to redirect the user to a malicious site, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/claim-free-robux-now-game-hack PDF link annotation
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/robux-free-online_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/roblox-hacks-2021_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/free-robux-generator-com-roblox-hack_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/free-robux-please_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/coin-master-free-spins-link-hack_GM406889139.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/how-to-make-a-private-server-on-roblox-for-free_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/how-to-make-free-robux-promo-codes_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/roblox-hack-generator_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/free-robux-real-working_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/free-coins-coin-master-blog_GM406889139.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/coin-master-hack-apk-link_GM406889139.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/roblox-free-hair-codes_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/roblox-studio-free-download_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/free-tiktok-followers_GM835599320.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/free-robux-instantly_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/robux-hack-that-works-when-you-use-card_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/how-to-get-a-free-skin-in-roblox_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/coin-master-free-spin-and-coin_GM406889139.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/robux-free-2021_GM431946152.pdfIn PDF document text
    • https://e-learning.mansapa.sch.id/__statics/gudangsoal/files/earn-robux-com_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003227.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3227 22260 bytes
SHA-256: 712d0264b943c8311910fc6d76a02b33bff4e199552f5e4a50aada349fb5766e
font_01_sfnt_off00006329.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6329 19148 bytes
SHA-256: 126799d62fb07b7a5ada61d2e3e3509631fbc9bca0aee380fcf2529b1e881495

Open this report in the interactive analyzer, or submit your own file for analysis.