PDF static analysis report

Static analysis result for SHA-256 8e49a3abf4b85d9e…

SUSPICIOUS

PDF

41.4 KB Created: 2021-04-27 06:59:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: e31f65aff4c3d67e73ef9a8357a2a654 SHA-1: 2e2d26c54cb2d7304ac5a8a1790e808d6e0b3a9e SHA-256: 8e49a3abf4b85d9e8fb0b368e0b31e5f32b9b8c5ab820793b87f0584693af82d
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a lure related to hacking Roblox, with an embedded URL pointing to a suspicious domain. The ML classifier also flagged this PDF as malicious. While no scripts were directly extracted, the presence of embedded URLs and the nature of the document suggest it is designed to trick users into visiting malicious sites, likely for credential harvesting or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-is-being-hacked-game-hack PDF link annotation
    • http://www.saburai.ac.id/elibrary//repository/how-to-get-free-robux-in-roblox-iphone.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/assassin-roblox-hacked-uncopylocked.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/hack-roblox-2021-youtube.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/daily-free-robux.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/download-games-to-get-free-robux.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/what-does-ce-stand-for-the-hack-for-roblox.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/hack-tool-for-roblox-pc.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/como-hackear-cuentas-de-roblox.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-get-free-robux-legit-with-proof.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-get-a-lot-of-robux-hack.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004109.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4109 26708 bytes
SHA-256: 20251a6960121cc6f11eb352e747e972927ceddcf6d3d82638e3b947774d1207
font_01_sfnt_off00007e8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7E8E 18764 bytes
SHA-256: 9bb29c28c16b6da6941cb6c67b5e6920b36930ec94170fac16681270141cbcf3

Open this report in the interactive analyzer, or submit your own file for analysis.