PDF static analysis report

Static analysis result for SHA-256 6bd9b39b81a51cfb…

SUSPICIOUS

PDF

51.9 KB Created: 2021-04-26 06:22:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 343ef3a23c9950ca1cf48370523a0c4c SHA-1: 0158534c649d6019f758d583b3a8378fee3291dc SHA-256: 6bd9b39b81a51cfbff724fed7b864451b961f67db12f9f8ae12635b72fad7f6c
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URL and multiple links within its body text, all pointing to sites offering 'Roblox hacks' or 'free Robux'. The ML classifier strongly flagged this PDF as malicious, and the presence of these links suggests an attempt to trick the user into downloading a secondary payload. No scripts were extracted, but the overall pattern is consistent with a phishing lure for game-related cheats.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9741

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-roblox-simulator-game-hack PDF link annotation
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/hacks-para-counter-blox-roblox.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/simple-roblox-robux-hack.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/code-to-put-into-console-to-get-free-robux.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/best-free-girls-roblox-outfits.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/superhero-city-hack-roblox.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/roblox-chat-script-hack.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-to-to-hack-joining-sumones-server-roblox.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/hacker-for-hire-roblox.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-to-hack-roblox-using-cheat-engine-65.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/get-free-robux-2021.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000407e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x407E 44008 bytes
SHA-256: ac6019a038bc5c2ef403cd94df032430ce9d4e049bc920017c6b0864850e05fe
font_01_sfnt_off00009e5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9E5B 2848 bytes
SHA-256: 4737c2778a085e0cb49e73f3b054b1a71e3f40720d213b4bfda97f95a31bfbf1
font_02_sfnt_off0000a81d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA81D 18800 bytes
SHA-256: e47785d617a084d4670781bf9c1fac3fc028970b41e34b1ebac57c28454ee421

Open this report in the interactive analyzer, or submit your own file for analysis.