PDF static analysis report

Static analysis result for SHA-256 8570d1aff77bbb96…

SUSPICIOUS

PDF

57.6 KB Created: 2021-04-05 20:28:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 5d549d139119a51508bc8c69c34b863d SHA-1: 065944be32c5926ea4ccb9d44e25105d3d3d7779 SHA-256: 8570d1aff77bbb96ca9bcef714914416fd2218b19060044633a03382d4620ddc
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs, with one prominently featuring 'free-robux-code-generator-dangerous'. The ML classifier also flagged the PDF as malicious. While no scripts were explicitly extracted, the presence of numerous suspicious URLs suggests the document is designed to redirect users to malicious sites, likely for malware download or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-robux-code-generator-dangerous PDF link annotation
    • http://jaeger-bauplanung.de/images/how-to-hack-someone-on-roblox-on-ipad.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/how-to-get-free-roblox-items-google.pdfIn PDF document text
    • http://fratellimazzoleni.it/images/roblox-hack-me-com.pdfIn PDF document text
    • http://eleveurs-autrement.fr/images/roblox-cheat-source-leaked.pdfIn PDF document text
    • http://www.lascalamilanowallcovering.it/images/free-transformer-roblox-costumes.pdfIn PDF document text
    • http://nalmpantistractors.gr/images/robux-hack-ohne-handy.pdfIn PDF document text
    • https://www.ncscolour.no/images/robux-hack-2021-no-human-verification.pdfIn PDF document text
    • http://www.isovca.com/images/free-robux-app-no-human-verification.pdfIn PDF document text
    • http://www.arredifunebri.com/images/free-robux-hack-generator-no-survey-no-human-verification.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/free-robux-hack-without-verification.pdfIn PDF document text
    • https://www.air-shop.cz/images/how-to-get-free-audio-jailbreak-roblox.pdfIn PDF document text
    • https://www.devries-group.de/images/roblox-digimon-aurity-cheat-engine.pdfIn PDF document text
    • http://icomsolutions.com.au/images/how-do-you-hack-roblox-account.pdfIn PDF document text
    • http://jdlrelocation.com/images/hack-roblox-accounts-website.pdfIn PDF document text
    • http://www.occquimica.com.br/images/how-to-get-robux-on-roblox-hack-no-human-verification.pdfIn PDF document text
    • https://rietenwinkel.nl/images/free-backpack-roblox.pdfIn PDF document text
    • http://www.meslekpatent.com/images/cheats-to-get-cars-in-car-crashers-2-roblox.pdfIn PDF document text
    • https://www.air-shop.cz/images/how-to-hack-roblox-for-unlimited-money.pdfIn PDF document text
    • http://cadcam.no/images/roblox-hacking-discords.pdfIn PDF document text
    • http://ghegamethu.vn/images/hacking-jakes-account-in-roblox.pdfIn PDF document text
    • https://www.showalterpropertyconsultants.com/images/free-robux-p.pdfIn PDF document text
    • https://www.foodsafety.cz/images/free-robux-hack-2021-android.pdfIn PDF document text
    • http://schrichte.de/images/free-robux-app-on-pc.pdfIn PDF document text
    • http://agrao.in/images/roblox-tbc-free.pdfIn PDF document text
    • http://energotestcontrol.ru/images/10k-robux-free.pdfIn PDF document text
    • http://bunadsmaria.com/images/new-oilgarchy-hack-roblox.pdfIn PDF document text
    • https://yarburservices.ru/images/roblox-free-adiidas.pdfIn PDF document text
    • http://www.web.stc-part.co.th/images/free-roblox-birthday-printables.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/roblox-piano-hack-mac.pdfIn PDF document text
    • http://www.awakeningtruth.org/images/how-to-get-free-shirts-on-roblox-no-bc-2021.pdfIn PDF document text
    • http://sb2m.com.br/images/how-to-hack-fly-on-skyward-roblox.pdfIn PDF document text
    • http://mostowicz.pl/images/free-roblox-studs.pdfIn PDF document text
    • https://www.knxuk.org/images/how-to-hack-accounts-on-roblox-2021.pdfIn PDF document text
    • https://abqyorkrite.org/images/free-robux-100-true.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/island-royale-roblox-hack-script.pdfIn PDF document text
    • https://schaefer-rechtsanwaelte.com/images/free-pink-shirt-roblox.pdfIn PDF document text
    • http://businessmart.ro/images/how-to-hack-roblox-accounts-real.pdfIn PDF document text
    • http://www.homesweethome.pl/images/how-to-get-free-robux-for-no-money.pdfIn PDF document text
    • http://immo360grad.com/images/how-to-get-free-robux-glitch-2021.pdfIn PDF document text
    • https://www.solucionesdigit.com/images/free-roblox-explosive.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/best-free-avatar-roblox-2021.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/cheat-roblox-gasoil-simulator.pdfIn PDF document text
    • http://islamkennis.com/images/roblox-cheat-engine-download-2021.pdfIn PDF document text
    • https://www.ausecus.com/images/roblox-bee-swarm-simulator-free-diamond-egg.pdfIn PDF document text
    • http://www.gadanie.lv/images/how-to-hack-your-friends-in-roblox.pdfIn PDF document text
    • http://solidkom.ch/images/free-obc--robux.pdfIn PDF document text
    • http://www.hawler.in/images/hacks-para-roblox-murder-mystery-2-xp.pdfIn PDF document text
    • http://www.boic.nl/images/how-to-hack-phantom-forces-on-roblox.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/roblox-com-free-gift-card.pdfIn PDF document text
    +18 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008286.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8286 25652 bytes
SHA-256: fac4f9346891c0df2bdb4986ca3fb8dab663a133cf9b8534de7cf0b8a51fb044
font_01_sfnt_off0000bce2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBCE2 18560 bytes
SHA-256: ae17d29af332d6d0165f75e3c0690047c565833a2e882b8c4dd716bf1f6db98f