PDF static analysis report

Static analysis result for SHA-256 698330ed979aa467…

SUSPICIOUS

PDF

35.0 KB Created: 2021-07-20 09:37:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9fc074e70f7c7aeb631d8c11f1454d6e SHA-1: aeaf67fe1bb2451d3e408df38e2df6320753b24d SHA-256: 698330ed979aa46782913420b99e04ca1337ddc74e41ff3f459bbf65d394efbb
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a prominent call-to-action related to obtaining free Robux, indicating a phishing or scam attempt. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests it is designed to redirect users to malicious sites for further exploitation. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9962

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-robux-without-human-verification-game-hack PDF link annotation
    • http://miperwanida.me/__statics/gudangsoal/files/free-robux-generator-no-survey_GM431946152.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/free-minecraft-website_GM479516143.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/roblox-hack-2021_GM431946152.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/free-coin-master-spins-blog_GM406889139.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/how-to-buy-robux-for-free_GM431946152.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/free-coin-master-spins_GM406889139.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/tiktok-likes-for-free_GM835599320.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/free-tiktok-accounts-and-passwords_GM835599320.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/real-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://miperwanida.me/__statics/gudangsoal/files/free-tiktok-hearts_GM835599320.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E91 23544 bytes
SHA-256: 2b3ec66730a8067998dd80169ad57e5e6cc0f63440b463fe6944e5a87a6b0a45
font_01_sfnt_off000063cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63CF 19408 bytes
SHA-256: ff7afc4c49fa68989faf24fc2a92bf17632869ed83bc21be7af310a18c588021

Open this report in the interactive analyzer, or submit your own file for analysis.