PDF static analysis report

Static analysis result for SHA-256 aa689ed625fb3752…

SUSPICIOUS

PDF

34.0 KB Created: 2021-07-08 05:53:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 87728c3f25ec28651aa6a9c879364286 SHA-1: 267201bcc33a9f6fe3d2e95d488ddad607ddfa0f SHA-256: aa689ed625fb37526447399a7a8c2922be7da525da57082a5dfbf0118987c7cf
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ML classifier strongly indicates maliciousness, and the document body contains multiple URLs related to game cheats and hacks, specifically for Roblox and Coin Master. The primary URL, http://netcdn.tw/app/431946152/roblox-hax-game-hack, is likely the download location for a malicious payload. The presence of embedded URLs and the nature of the content suggest a lure to download unwanted or malicious software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/roblox-hax-game-hack PDF link annotation
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/free-gamepass-script-roblox-2021_GM431946152.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/free-download-coin-master_GM406889139.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/appbounty-net-free-robux_GM431946152.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/roblox-hack-download-pc_GM431946152.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/roblox-game-free-download_GM431946152.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/coin-master-free-spin-daily-link_GM406889139.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/how-to-hack-someones-roblox-account_GM431946152.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/how-can-you-hack-robux_GM431946152.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/how-do-i-get-free-robux-tix-and-obc-lifetime_GM431946152.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/lots-of-robux_GM431946152.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-on-pc_GM431946152.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/coin-master-heaven-free-spins_GM406889139.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/coin-master-hack-2021-app-download_GM406889139.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/how-do-you-get-free-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/coin-master-2021-free-spins_GM406889139.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/how-to-get-java-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/robux-hack-client-download_GM431946152.pdfIn PDF document text
    • http://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/coin-master-free-spins-2021-no-human-verification_GM406889139.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/kristjon-15k-robux-reward-hack-tutorial_GM431946152.pdfIn PDF document text
    • https://elearning.man1indramayu.sch.id/__statics/gudangsoal/files/free-robux-no-verify-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003017.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3017 22180 bytes
SHA-256: 6a646481ea1628b67d0dc709d5af11e53ff1a4543cc41df354ae7b7eef87b6b4
font_01_sfnt_off0000612d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x612D 18484 bytes
SHA-256: b8dc14ea2b02e669609a9bed4b879ffd3613a1e7230b7afd8459ca1023f54c8f

Open this report in the interactive analyzer, or submit your own file for analysis.