PDF static analysis report

Static analysis result for SHA-256 73c2cbba99f4515a…

SUSPICIOUS

PDF

33.4 KB Created: 2021-06-18 00:47:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 3c37a4cdadd5a75de4ed70fd4074725e SHA-1: 56770d280c135074cfde6c01598ba3e4f664dc02 SHA-256: 73c2cbba99f4515af858a06451fc1aac59b20d0d0e27e85e56d381cc8261607f
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous links to external websites, including one at http://netcdn.co/app/431946152/red-boy-roblox-jailbreak-hack-game-hack, which likely serves as a lure for downloading a malicious payload. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is designed for user deception and potential exploitation. No scripts were extracted, but the presence of external links and the ML detection indicate a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/red-boy-roblox-jailbreak-hack-game-hack PDF link annotation
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-robux-no-verification-easy_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/bee-game-roblox-cheat-codes_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/how-to-cheat-on-roblox-games_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/goku-free-cloth-roblox_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/how-to-get-free-robux-2021-easy_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-builders-club-2021-roblox_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-robux-quiz-roblox_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/roblox-free-robux-hack_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/roblox-cheats-for-mac_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-robux-really-fast_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/youtube-roblox-free-robux-without-downloads-legit-2021-urban420-network_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/roblox-field-of-battle-gold-hack-2021_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/how-to-get-free-item-on-roblox-2021-and-2021_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/roblox-speed-hack-mega_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/hack-roblox-ropa_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/change-you-roblox-name-for-free_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-roblox-hack-no-inspect-no-username-november-2021-pc_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/hacked-robux-oh-shit-meme_GM431946152.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/coin-master-free-cards_GM406889139.pdfIn PDF document text
    • https://zbych-pol.pl/wp-content/uploads/fsqm-files/comment-cheat-sur-le-jeux-jailbreak-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002b0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B0E 22520 bytes
SHA-256: 70f4f67774439ba5fc0586dc8a6fdd934d533c8b101380a04af327a2ee7d285d
font_01_sfnt_off00005d73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D73 19108 bytes
SHA-256: 1bc6270cf4d128644e67eb088c739eebce87f012c9abd7ce8a308b41c7abd1d6