PDF static analysis report

Static analysis result for SHA-256 6e401fb4c8b3b2d4…

SUSPICIOUS

PDF

40.7 KB Created: 2021-05-02 07:33:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 62c680edaf758e643a44a6a05011014b SHA-1: 9331a34fd5891cdcdd75c2ef147f57f5783232d8 SHA-256: 6e401fb4c8b3b2d4bc28334cc52cbf1790e935f9b1f014ac886206d94c62a5b4
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a prominent link to a website offering free Robux, a common lure for phishing and scam operations. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were directly extracted, the presence of embedded URIs and the document's content suggest an attempt to redirect users to potentially harmful external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/google-how-do-you-get-free-robux-on-roblox-game-hack PDF link annotation
    • https://fridaytravelnepal.com/userfiles/files/how-to-hack-your-roblox-account-to-get-robux.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/bad-business-cheat-roblox.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-cheats-phone.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/how-to-get-free-catalog-items-on-roblox-2021.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-robux-2021-en.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-hack-download-code-unlimited-robux.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/is-there-a-way-to-get-free-robux.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-absract-free-cheat-engine.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/how-to-get-free-robux-on-roblox-no-human-verification.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/best-free-roblox-items-2021.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000040de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40DE 25740 bytes
SHA-256: bce1cd28852980e60ce4972997cd6f580e36a589044fbc7d105a005428bd85a5
font_01_sfnt_off00007b14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B14 18972 bytes
SHA-256: fbbaf4a05cc30bbbae5c673e4529c259f4bbe518bd38ed26ebd8e2f2fcb4c5db

Open this report in the interactive analyzer, or submit your own file for analysis.