PDF static analysis report

Static analysis result for SHA-256 9af35d37eeb002d3…

SUSPICIOUS

PDF

36.1 KB Created: 2021-06-29 17:45:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 39ab644b9cbef10ec034c8f5ebcdcb26 SHA-1: 37e4f34fba429f8048ebb84924eeca4ea4799c3f SHA-256: 9af35d37eeb002d337f6fbc558f760587f0c17c0e963afd72ce2ed5d5dcd9bc9
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier strongly indicates maliciousness, and the document body contains lures for free game currency and hacks, directing users to download files from external URLs. The presence of embedded URLs and the document's theme suggest a phishing or scam attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/202100-robux-promo-code-free-game-hack PDF link annotation
    • http://rightlead.com.tw/image/data/files/minecraft-pe-apk-free-download_GM479516143.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/booga-booga-roblox-hack_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/coin-master-daily-free-spins_GM406889139.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/free-robux-human-verification_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/coin-master-free-spin-bonus_GM406889139.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/free-roblox-robux-no-human-verification_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/coin-master-free-cards-hack_GM406889139.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/pubg-uc-app-download_GM1330123889.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/free-robux-hack-no-verification_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/robux-free-gift-card-org-hack_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/robuxmatch-com-free-robux_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/free-robux-no-human-verification-2021-working_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/free-coin_GM406889139.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/roblox-speed-hack-feb-10_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/coin-master-links-2021_GM406889139.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/god-mode-hack-roblox-2021_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/minecraft-18-9-hacked-client_GM479516143.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/roblox-hack-scripts-pastebin_GM431946152.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/twitter-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://rightlead.com.tw/image/data/files/roblox-apk-hack-android_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000328a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x328A 23036 bytes
SHA-256: 83ccf149af2e512c377d5874e2bea55d9242964de68e48c9497efce5862530fb
font_01_sfnt_off0000664c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x664C 19708 bytes
SHA-256: 271bafec16c422bd165c3fe5a628bd84575c09213c89c29075d4379e237c55b7

Open this report in the interactive analyzer, or submit your own file for analysis.