PDF static analysis report

Static analysis result for SHA-256 a3137f73e8d9e46b…

SUSPICIOUS

PDF

35.0 KB Created: 2021-06-28 05:48:22 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 88e639464129b6ab1ad90d8f5a3a5ca6 SHA-1: ad7ceb6b521097173c93ece2c135bf29c7d2ade7 SHA-256: a3137f73e8d9e46b2e09ba46e830b2959b3cb17e7ad20bee36c3e6fc6f479f4e
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a document body that promotes 'free Robux' and game hacks, indicating a lure for potentially unwanted software or phishing. The ML classifier strongly flagged this PDF as malicious. While no scripts were directly extracted, the presence of external URIs suggests the document is designed to redirect users to malicious sites for downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-kozak-game-hack PDF link annotation
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/rbxoffers-com-free-robux_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-roblox-dominus-november-2021_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-in-app-purchases-roblox-pc_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-earn-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/robux-hack-201_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-coin-master-spins-links-2021_GM406889139.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-robux-mobile_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-coin-app_GM406889139.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-promo-codes-for-roblox-2021_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/mcpe-master-hack-coin-apk_GM406889139.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/robuxmatch-com-free-robux_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-can-i-get-free-coinsn-coin-master_GM406889139.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-daily-free-spins-blogspot_GM406889139.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-robux-microsoft_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-game-2021-free-spin-link_GM406889139.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/earn-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/roblox-tokyo-ghoul-bloody-nights-hack_GM431946152.pdfIn PDF document text
    • http://kpu-denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-free-daily-spins-2021_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003270.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3270 22368 bytes
SHA-256: b7b8f7e5f929af0744ea46d9f62344c3374a052d51852c49c2a3178df4daaae3
font_01_sfnt_off000063f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63F9 18968 bytes
SHA-256: 57e23534124adcfe9f4e19feb3f04931d83150820d70b6df657d5b57197ffc54

Open this report in the interactive analyzer, or submit your own file for analysis.