PDF static analysis report

Static analysis result for SHA-256 9dd36c9dfa2f7b4d…

SUSPICIOUS

PDF

43.4 KB Created: 2021-05-21 22:13:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: c7c93ddbb11bff6bbeba33c5d0bf5161 SHA-1: 5bfa5620456890e517829b7f7ddad9ec8d1185c2 SHA-256: 9dd36c9dfa2f7b4d179074330507b785b7ad97730c44250064c696496c533aeb
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains multiple embedded URLs and a visual download button, strongly suggesting a social engineering attempt to trick users into downloading potentially malicious software. The ML classifier also flagged the PDF as malicious. The primary lure appears to be related to 'Roblox' game hacks, with one URL directly pointing to a 'free-executors-for-roblox-game-hack' resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7947

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-executors-for-roblox-game-hack PDF link annotation
    • http://italymania.ru/images/how-to-hack-roblox_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/coin-master-hack-injection_GM406889139.pdfIn PDF document text
    • http://italymania.ru/images/easy-ways-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/roblox-hack-2021_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/free-robux-instantly_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32AB 27672 bytes
SHA-256: c921db8694c98c395cdafcbc9064d305c07f25bdf51915e8c60b7599a529fa06
font_01_sfnt_off000071ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x71AB 2844 bytes
SHA-256: baad2f3f6808f4af03fa9398e38c580c8d846f7f773a947d8cc1f39b2753d31a
font_02_sfnt_off00007b67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B67 5696 bytes
SHA-256: 450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139
font_03_sfnt_off00008879.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8879 18192 bytes
SHA-256: 0010e8e9d3b2fa3a2033abb01eb6105ec98c225a2498b2eb90ac9377a6b08ddc

Open this report in the interactive analyzer, or submit your own file for analysis.