PDF static analysis report

Static analysis result for SHA-256 7566bed13e4a978d…

SUSPICIOUS

PDF

33.0 KB Created: 2021-04-03 23:00:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-01
MD5: 5e4c896dee9dcafee7733ce19ad34e9f SHA-1: 91d4ac0c34df78c862e8a6f86e77db42efdc0bfa SHA-256: 7566bed13e4a978d634f866b595c18cbbc5934a0c31ab75b67cd8bc22a64d1a9
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as suspicious by an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-look-like-a-minecraft-hacker-in-roblox PDF link annotation
    • http://lichtdrukkerijwijchen.nl/images/hack-to-get-robux-2021.pdf%0AIn PDF document text
    • https://consorziocsa-asicaivano.it/images/best-app-to-get-free-robux.pdf%0AIn PDF document text
    • http://nosocomium.rv.ua/images/roblox-magitan-hack-november-2021.pdf%0AIn PDF document text
    • https://pemadamapi.net/images/free-robux-generator-youtube.pdf%0AIn PDF document text
    • http://www.occquimica.com.br/images/freecodepro-how-to-get-free-roblox.pdf%0AIn PDF document text
    • https://www.dierenartsberghman.be/images/free-item-codes-murder-mystery-2-roblox.pdf%0AIn PDF document text
    • https://www.ncscolour.no/images/how-to-hack-any-items-free-roblox.pdf%0AIn PDF document text
    • http://svp-steinmaur.ch/images/free-money-hack-roblox-vehicle-simulator.pdf%0AIn PDF document text
    • http://www.gadanie.lv/images/como-descargar-hacks-para-roblox-2021.pdf%0AIn PDF document text
    • http://www.adravietnam.org/images/roblox-free-robux-hack-script.pdf%0AIn PDF document text
    • http://uptodate.az/images/bomb-hair-salon-roblox-no-hacks.pdf%0AIn PDF document text
    • http://www.mjclautrec.fr/images/how-to-get-free-hair-modles-roblox.pdf%0AIn PDF document text
    • https://www.cpnf.ch/images/how-to-hack-roblox-robux-with-cheat-engine-64.pdf%0AIn PDF document text
    • http://www.lovecraftiana.com.ar/images/roblox-county-free.pdf%0AIn PDF document text
    • http://www.agri-tech.com.au/images/free-robux-generater-no-human-verificaition.pdf%0AIn PDF document text
    • http://www.mikramarine.gr/images/gg-roblox-hack.pdf%0AIn PDF document text
    • http://zarinnameh.ir/images/roblox-free-robux-hack-script.pdf%0AIn PDF document text
    • https://www.udivadlahotel.cz/images/can-cheat-engine-hack-roblox.pdf%0AIn PDF document text
    • http://poltekkeskhjogja.ac.id/images/hack-nuevo-para-roblox-2021-editar-servidor.pdf%0AIn PDF document text
    • https://www.eglihotel.gr/images/free-script-runner-for-roblox.pdf%0AIn PDF document text
    • https://billiekawende.com/images/how-to-make-shirts-for-free-roblox.pdf%0AIn PDF document text
    • https://www.seeingindependence.org/images/fly-hack-exploit-roblox.pdf%0AIn PDF document text
    • https://ballaratcaravans.com.au/images/free-robux-poster.pdf%0AIn PDF document text
    • https://www.iadh.bi/images/cheat-engine-for-roblox-2021.pdf%0AIn PDF document text
    • http://www.remiauclair.fr/images/free-cool-pants-roblox.pdf%0AIn PDF document text
    • http://sscclc.edu.ec/images/roblox-cheat-enginefly-hack.pdf%0AIn PDF document text
    • https://www.milewood.co.uk/images/roblox-robux-hack-no-survey-or-verification.pdf%0AIn PDF document text
    • http://zarinnameh.ir/images/free-robux-no-human-verification-and-no-survey.pdf%0AIn PDF document text
    • https://www.saisystem.it/images/free-robux-for-kids-no-human-verification.pdf%0AIn PDF document text
    • https://www.ncscolour.no/images/roblox-message-hack.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000346f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x346F 19256 bytes
SHA-256: cd7ba067d216b4541a09b4395dea6b9ec5584b87a9d865933395f9b9fa75e538
font_01_sfnt_off00005cb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5CB8 18460 bytes
SHA-256: c49796d173fcae5c8e646e397d631c96992157236491e5a39eed6a5274d55c63