PDF static analysis report

Static analysis result for SHA-256 98a4e831bcaa9658…

SUSPICIOUS

PDF

35.2 KB Created: 2021-06-27 02:48:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: b16943eedffd9b820c6cbba1608c8cb5 SHA-1: cb01866531af56213331cae09b382a79ecf5b869 SHA-256: 98a4e831bcaa96589136479e2b4981aa03220176a163d23df9623cbcac126314
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document body and extracted URLs indicate a lure for free Robux or Coin Master spins, a common social engineering tactic. The PDF contains embedded URIs pointing to sites offering these 'freebies', which are likely scams or lead to further malware. The ML classifier strongly flagged this PDF as malicious, supporting the suspicious nature of the content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-legally-get-free-robux-game-hack PDF link annotation
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/coin-master-free-spins--coins-2021_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/free-coin-master-spins-without-human-verification_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/download-the-cheat-tool-for-roblox_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/get-me-free-robux_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/collect-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/coin-master-free-spins-cheat-deutsch_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/free-robux-generator-2021_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/minecraft-wurst_GM479516143.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/how-to-get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/roblox-hack-site_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/microsoft-rewards-robux_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/coin-master-free-spin-and-coins-fbid-links_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/get-me-robux-for-free_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/minecraft-hacker-mask_GM479516143.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/how-can-i-get-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/free-coin-master-spins-hack_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/coin-master-spin-free_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/free-daily-spins-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/roblox-hack-download-pc_GM431946152.pdfIn PDF document text
    • http://elearning.mts-al-ikhlas-woimenda.sch.id/__statics/gudangsoal/files/roblox-robux-hack_GM431946152.pdfIn PDF document text
    • https://www.roblox.com/.IIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34C7 21496 bytes
SHA-256: 199f1a13253b8b4dab13a6c6363ece461e605cccd8753a798484a3ccbe85ca5d
font_01_sfnt_off000063e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63E5 19240 bytes
SHA-256: 5d97cac5917a9609a2f98775a152504bc099b5aa7482911aa8bd4e5f9efa6c4b

Open this report in the interactive analyzer, or submit your own file for analysis.