PDF static analysis report

Static analysis result for SHA-256 82ce49be3eee4dd2…

SUSPICIOUS

PDF

34.0 KB Created: 2021-06-30 12:26:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: bdcae7a1ae31400c2c3f76b8d4c836fd SHA-1: 629dd4e052b64bd60d83731be82664b587175002 SHA-256: 82ce49be3eee4dd2b4dadb0ca9a7593b189ac43f978363576a62c23140c3db9a
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document contains numerous URLs related to free game items and hacks, with a primary URL pointing to a potential download. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of it being used to deliver a payload. The presence of embedded URLs and the lure of free items suggest a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-unused-roblox-card-codes-2021-game-hack PDF link annotation
    • http://pustaka.fk.unand.ac.id/repository/hack-roblox-flood-escape-2_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/free-money-in-roblox-bloxburg_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/free-robux-redeem-codes_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/cheat-doodle-robux_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/how-to-get-free-robux-on-tablet-easy_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/hack-script-for-roblox-prison-life_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/minecraft-tiktok-hacks_GM479516143.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/how-to-make-a-free-admin-game-in-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/free-roblox-gams_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/free-robux-games-that-actually-work-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/free-roblox-promo-codes-2021-april_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/best-free-survival-games-on-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/free-exploit-lvl-7-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/how-to-hack-people-on-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/comment-avoir-de-largent-hack-sur-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/how-to-get-free-robux-with-editthiscookie_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/roblox-attach-to-debugger-cheat-engine_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/coin-master-daily-free-spin-app_GM406889139.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/roblox-pants-black-free_GM431946152.pdfIn PDF document text
    • http://pustaka.fk.unand.ac.id/repository/hacks-to-g-et-into-houses-on-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F0B 21616 bytes
SHA-256: 4799c5bfa4baa6410f6f743d8bb111ac9ee29679f08e1197440031f686732274
font_01_sfnt_off00005eb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5EB7 19364 bytes
SHA-256: c8ead2f24ea4a0466f700dbf6317eb922f0a95c6aec922b55d69f94d611923d0

Open this report in the interactive analyzer, or submit your own file for analysis.