PDF static analysis report

Static analysis result for SHA-256 7043b485d2242423…

SUSPICIOUS

PDF

33.7 KB Created: 2021-07-03 12:12:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: acadc7e88fbc2f14302c32e7ff9f763a SHA-1: f7f1c10578e48a70399c4fc9400d5749dcf6fce8 SHA-256: 7043b485d22424236b8f9a611b3ac3f4bb3431a4a60d9f0cd01804f8d210ef72
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier strongly flagged this PDF as malicious. The document body and extracted URLs indicate a lure for game-related cheats or currency, specifically mentioning 'Free Robux' and various game hacks. The presence of embedded URLs suggests the document is designed to redirect users to external sites, likely to download further malware or engage in phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-robux-link-game-hack PDF link annotation
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/free-minecraft-texture-packs_GM479516143.pdfIn PDF document text
    • http://ma-hidayatulinsanpky.online/__statics/gudangsoal/files/coin-master-gold-cards-hack-english_GM406889139.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/roblox-trolling_GM431946152.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/coin-master-fun-hack-online_GM406889139.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/minecraft-115-2-hacks_GM479516143.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/how-to-hack-roblox_GM431946152.pdfIn PDF document text
    • http://ma-hidayatulinsanpky.online/__statics/gudangsoal/files/coin-master-mod-version-free-download-v344_GM406889139.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/free-robux-card-codes_GM431946152.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/how-do-you-hack-roblox_GM431946152.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/cheat-bubble-gum-simulator-de-roblox_GM431946152.pdfIn PDF document text
    • http://ma-hidayatulinsanpky.online/__statics/gudangsoal/files/kann-man-in-roblox-robux-hack_GM431946152.pdfIn PDF document text
    • http://ma-hidayatulinsanpky.online/__statics/gudangsoal/files/roblox-admin-hack_GM431946152.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/roblox-guess-that-song-cheat_GM431946152.pdfIn PDF document text
    • http://ma-hidayatulinsanpky.online/__statics/gudangsoal/files/pokemon-go-free-rare-candy_GM1094591345.pdfIn PDF document text
    • http://ma-hidayatulinsanpky.online/__statics/gudangsoal/files/april-1-2021-roblox-hacking_GM431946152.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/robux-rewards_GM431946152.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/free-tiktok-comments_GM835599320.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/boku-no-roblox-hack_GM431946152.pdfIn PDF document text
    • http://www.ma-hidayatulinsanpky.online/__statics/gudangsoal/files/how-to-earn-robux-by-playing-games_GM431946152.pdfIn PDF document text
    • http://ma-hidayatulinsanpky.online/__statics/gudangsoal/files/games-like-minecraft-but-free_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f93.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F93 21572 bytes
SHA-256: 3a7e0730339f2b9fe2d481b600d3595808c76868f5c658e6e6b7a87fe12ebaea
font_01_sfnt_off00005efa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5EFA 19008 bytes
SHA-256: a11a737a93c2cddb47bbb5a91c346e1b782ee8df03973ee462993f1f8904f3c0

Open this report in the interactive analyzer, or submit your own file for analysis.