PDF static analysis report

Static analysis result for SHA-256 72d3e41d6cc2cfe3…

SUSPICIOUS

PDF

41.8 KB Created: 2021-05-23 12:37:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: ccb9d9e1938151d2495168386c3614ee SHA-1: de2b968d0a5421db7fbf483a7793e6318726545d SHA-256: 72d3e41d6cc2cfe3ddd904810532ab54ee696bd7b2899dc989bb6f0756c8064b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple URLs pointing to sites offering free in-game currency or hacks, suggesting a phishing or scam attempt. The ML classifier also flagged the PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the document's content strongly indicate an attempt to trick users into downloading further malware or engaging in fraudulent activities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8078

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/835599320/tiktok-likes-for-free-game-hack PDF link annotation
    • http://moringaforlove.com/images/roblox-free-download_GM431946152.pdfIn PDF document text
    • http://moringaforlove.com/images/minecraft-mojang-free_GM479516143.pdfIn PDF document text
    • http://moringaforlove.com/images/oprewards-free-robux_GM431946152.pdfIn PDF document text
    • http://moringaforlove.com/images/free-robux-hack-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
    • http://moringaforlove.com/images/how-to-get-free-robux-on-roblox-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000317c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x317C 26204 bytes
SHA-256: 56023d4aaa1e0dbe92fe1ed9b1d5207a081c06cdcf08bc9ffaab9caed8e22068
font_01_sfnt_off00006d88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D88 3372 bytes
SHA-256: dfbbf67cbc7ecc66ac4d03805ccfff7e5c1407898ea3c5e2b9241b85217ff1cd
font_02_sfnt_off00007909.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7909 3120 bytes
SHA-256: 49734f51977507cba6bc8d3ad0cee0363aa119856db094427deb9cf565bb7bca
font_03_sfnt_off0000841c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x841C 17456 bytes
SHA-256: 6bc07a916d4e04dd857b15fc22f6a85a1633f574b63a4730ea8dc15634c660b5

Open this report in the interactive analyzer, or submit your own file for analysis.