PDF static analysis report

Static analysis result for SHA-256 61af35f4f0bdbc5b…

SUSPICIOUS

PDF

49.7 KB Created: 2021-06-08 14:23:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: c61e99ca34c8d899a69150c9a181fa55 SHA-1: aaa0817b9121d7e970e4fd0f8dba77c8c3a971fd SHA-256: 61af35f4f0bdbc5b6049c9215c7edd252cb43a423a2f181c83fc74a638f06bed
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a call-to-action lure related to obtaining free Robux, indicating a phishing or scam attempt. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of external URIs and the document's theme suggest it is designed to redirect users to potentially malicious sites for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/how-to-get-free-robux-no-hacks-2021-game-hack PDF link annotation
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-cheats-for-pc_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/how-too-hack-in-superhero-simulator-roblox_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/is-there-a-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/free-roblox-download-for-wimndows-10_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-phantom-forces-free-money_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/robux-gratis-free_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-cheat-engine_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/free-download-roblox-for-windows-7-32-bit_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/get-minecraft-for-free_GM479516143.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/you-promised-my-son-free-robux_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-cheats-deutsch_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-cheat-guide_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/coin-master-spin-free_GM406889139.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/free-spins-coin-master-unlimited_GM406889139.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/how-to-hack-roblox-and-get-infinite-health_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/cheat-engine-for-roblox-2021_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/free-spin-in-coin-master_GM406889139.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/bleus-free-robux_GM431946152.pdfIn PDF document text
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/get-free-robux-com_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55F6 26776 bytes
SHA-256: eca56b06f1cb0cd84bff737b193a09433c1bc95a84d6ee9f4733730044b6468c
font_01_sfnt_off0000931d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x931D 2844 bytes
SHA-256: baad2f3f6808f4af03fa9398e38c580c8d846f7f773a947d8cc1f39b2753d31a
font_02_sfnt_off00009cdf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9CDF 19084 bytes
SHA-256: 1f0d86e8bfc10f9149dc8a799f65c943baf2453419d556edfd674b48fd7db653

Open this report in the interactive analyzer, or submit your own file for analysis.