PDF static analysis report

Static analysis result for SHA-256 889799baec86c7d7…

SUSPICIOUS

PDF

40.9 KB Created: 2021-04-25 16:59:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: d9700e0fddd1ff0032265ce7de6d8c89 SHA-1: 432c1cdf784c7499f64f09cedcf69bdf72382723 SHA-256: 889799baec86c7d77770a5128cf373f61aabd5e3400705655633f12381b110a1
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a visual call-to-action, strongly suggesting it is a lure for downloading malicious content. The ML classifier also flagged this PDF as malicious. The presence of multiple URLs related to game hacks and exploits indicates a phishing attempt to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/mad-city-roblox-hack-game-hack PDF link annotation
    • http://www.drent.se/images/roblox-hack-download-pc-2021.pdfIn PDF document text
    • http://www.drent.se/images/can-you-give-me-free-robux.pdfIn PDF document text
    • http://www.drent.se/images/cheat-engine-roblox-jailbreak-hack.pdfIn PDF document text
    • http://www.drent.se/images/free-robux-promo-code-gen-2.pdfIn PDF document text
    • http://www.drent.se/images/how-to-change-roblox-username-for-free-2021-mobilr.pdfIn PDF document text
    • http://www.drent.se/images/roblox-high-school-how-to-fly-for-free.pdfIn PDF document text
    • http://www.drent.se/images/cheats-in-roblox-pet-simulator.pdfIn PDF document text
    • http://www.drent.se/images/can-you-use-cheat-engine-to-hack-robux.pdfIn PDF document text
    • http://www.drent.se/images/how-do-you-hack-your-friend-on-roblox.pdfIn PDF document text
    • http://www.drent.se/images/free-stuff-to-get-in-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004206.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4206 26024 bytes
SHA-256: 5a5fb47556da7d977465e204ed74a1074369a27a4cbf653f871e413364a62b25
font_01_sfnt_off00007c07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C07 18956 bytes
SHA-256: 362b1931ebd17dfb2ab5181aad32e37bcd98d21c137277b2c371ffa0802a330a

Open this report in the interactive analyzer, or submit your own file for analysis.