PDF static analysis report

Static analysis result for SHA-256 9b691c819e5b5f9a…

SUSPICIOUS

PDF

33.6 KB Created: 2021-06-28 00:04:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: ae682d53a2b83061de77617c81e5ea54 SHA-1: 91ec9011cb82559afc5ce58b300188629ceba818 SHA-256: 9b691c819e5b5f9af70d8642755a3068af4495632305b496a2d1e520832fe282
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a document body that explicitly promises hacks and free in-game currency for popular games. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of it being used for phishing or distributing malware. The presence of external URIs suggests the document is designed to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-do-you-hack-on-roblox-2021-game-hack PDF link annotation
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/free-robux-2021-hack-pc_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/coin-master-free-spins-link-download_GM406889139.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/rblx-city-free-robux_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/how-to-get-free-robux-easy-on-phone_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/free-robux-download_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/how-to-have-free-robux-in-august-2021_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/how-to-get-free-shirts-on-roblox_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/how-to-get-free-robux-on-chromebook_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/offers-for-robux_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/real-robux_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/minecraft-java-free-account_GM479516143.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/free-robux-mobile_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/free-gamepass-roblox-pastebin_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/minecraft-hacked-client_GM479516143.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/free-roblox-no-sign-in-account-roblox_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/earn-roblox-free_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/free-robux-offers_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/coin-master-hack-version-2021-download_GM406889139.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • http://ntweac.edu.hk/admin/ckfinder/userfiles/files/roblox-tix-generator_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D4A 21300 bytes
SHA-256: d3c96246d41967c13d94967450bff75d0eb24544fc98d07b463b2b4ee0f0d338
font_01_sfnt_off00005bf1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5BF1 19692 bytes
SHA-256: b143aeabf9c87880701ca470709d7b8d0e5f10c6c7db3afd4a7a302832e195fa

Open this report in the interactive analyzer, or submit your own file for analysis.