PDF static analysis report

Static analysis result for SHA-256 aba5aa9c068db759…

SUSPICIOUS

PDF

32.9 KB Created: 2021-06-20 04:12:20 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 2f6f08af8ce2abceb806388650ce9e63 SHA-1: 61abd2e8f6ecc81da7198316b848f1a2deb9fdd6 SHA-256: aba5aa9c068db7595c802c456791cc060d9adc8bf2cf5fd94c0a51a3099073e2
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and text that lure users into downloading free Robux or game cheats, indicating a phishing or potentially unwanted software distribution scheme. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs further supports this assessment. No scripts were extracted, but the document's structure and content suggest it is designed to trick users into clicking links that lead to malicious downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-no-game-hack PDF link annotation
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/free-robux-instantly_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/roblox-invincibility-cheat_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/daily-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/minecraft-windows-10-hacked-client_GM479516143.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/coin-master-free-spins-2021_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/100-free-spins-coin-master-link_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/coin-master-hack-android_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/coin-master-hacks-for-gold-cards_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/free-spins-coin-master-2021-app_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/how-to-hack-to-get-a-girlfriend-in-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/coin-master-how-to-get-japan-sushi-card-free_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/www-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/how-does-a-roblox-account-get-hacked_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/free-robux-no-anti-bot-verification_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/get-free-robux-without-doing-anything_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/counter-blox-roblox-offensive-wall-hack_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/rbx-claim_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/free-robux-generator-no-ads-or-surveys_GM431946152.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/haktuts-coin-master-free-spins-2021_GM406889139.pdfIn PDF document text
    • https://elearning.min1lebak.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-instantly_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002bd8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BD8 22212 bytes
SHA-256: 59b82dabb0ed94d9ca8728a3dc45816895e67062fac30f1626592700696758cc
font_01_sfnt_off00005ce4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5CE4 18716 bytes
SHA-256: 6e3cf5dd8f3b5ed5c05a4bb4148e5b3860451048bae91d2467be76806b8564fd

Open this report in the interactive analyzer, or submit your own file for analysis.