PDF static analysis report

Static analysis result for SHA-256 8c2a9bc9dc213967…

SUSPICIOUS

PDF

35.9 KB Created: 2021-06-20 15:45:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: fdb168bdae7ea4bf2030147cd2273b88 SHA-1: a3452d5630cfdef9d4822e514fe371fbe94bd5c3 SHA-256: 8c2a9bc9dc21396742e7482cd52eb3c8d10a29a5ec16b85347147e3319faaa9b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a prominent external URI pointing to a download site, suggesting it's a lure for users seeking in-game advantages. The ML classifier strongly flagged this PDF as malicious, and the document body's content reinforces the phishing theme. While no scripts were directly extracted, the presence of embedded URLs and the ML detection indicate a high likelihood of this document being used to distribute malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-discord-webhooks-game-hack PDF link annotation
    • https://www.ferraroni.net/public/risorse/ck/files/ez-points-free-robux_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/coin-master-hack-spin-generator-tool_GM406889139.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/free-minecraft-items-in-roblox_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/make-free-robux_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/give-free-robux_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/roblox-robux-hack-generator_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/free-minecraft-skin-maker_GM479516143.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/free-promo-codes-for-roblox-2021_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/how-to-hack-roblox-for-robux_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/oprewards-login_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/minecraft-building-hacks_GM479516143.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/how-to-get-free-spins-and-coins-on-coin-master_GM406889139.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/minecraft-server-hacks_GM479516143.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/free-robux-websites-that-work_GM431946152.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/how-to-get-tiktok-likes-for-free_GM835599320.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/coin-master-hack-without-root_GM406889139.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/google-play-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/coin-master-rewards-free-spins_GM406889139.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/free-spins-coin-master-app-iphone_GM406889139.pdfIn PDF document text
    • https://www.ferraroni.net/public/risorse/ck/files/free-attacks-on-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000340c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x340C 22544 bytes
SHA-256: 684045efd435f6c79bf5c4e9fc22e9bd56b91b4cbe4dc89a1ebb12a432589af8
font_01_sfnt_off000065d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65D0 19648 bytes
SHA-256: a7e93b8b935a39ad7a5bc1e9a6b57521515cd7bfb66756439e2a296b0ef7e8d7