PDF static analysis report

Static analysis result for SHA-256 b854fcde6209410b…

SUSPICIOUS

PDF

34.0 KB Created: 2021-06-22 04:40:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 6b18e645ed362e588cc6efd6973a3929 SHA-1: 29aaceb27f7ab3074f79ff56f5b45a070a282c29 SHA-256: b854fcde6209410b055fc5733187ae1203b0d96f04e6357eb468530669b196f5
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a document body that explicitly mentions "Commands For Roblox Free Rubux" and "free robux script", indicating a lure for users seeking game cheats. The presence of an external URI pointing to "netcdn.co" suggests an attempt to download further malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/commands-for-roblox-free-rubux-game-hack PDF link annotation
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/minecraft-java-code-free_GM479516143.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/minecraft-for-free-games_GM479516143.pdfIn PDF document text
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/free-coin-master-generator_GM406889139.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/how-to-hack-roblox-to-get-robux_GM431946152.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/how-to-hack-roblox-accounts-2021_GM431946152.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/easiest-money-hack-febuary-roblox-rocitizens_GM431946152.pdfIn PDF document text
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/minecraft-app-store-free_GM479516143.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/anzeigewwwwowcom-roblox-cheats-free_GM431946152.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/coin-master-hack-review_GM406889139.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/coin-master-hacks-and-cheats_GM406889139.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/coin-master-free-spins-links-app_GM406889139.pdfIn PDF document text
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/worst-client_GM479516143.pdfIn PDF document text
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/how-to-get-free-shirts-on-roblox_GM431946152.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/free-robux-script_GM431946152.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/coin-master-hack-apk-35-8_GM406889139.pdfIn PDF document text
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/free-robux-no-human-verification-or-survey-or-download_GM431946152.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/optifine-mcpe_GM479516143.pdfIn PDF document text
    • https://pasangindovisionjogja.com/ckfinder/userfiles/files/free-robux-generator-codes_GM431946152.pdfIn PDF document text
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/minecraft-bedrock-free-with-java_GM479516143.pdfIn PDF document text
    • https://www.pasangindovisionjogja.com/ckfinder/userfiles/files/free-rpg-games-to-steal-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F44 21832 bytes
SHA-256: 797eda29e25b4642d4521910647907ac50967ff56dc62a1d053ffe806c76cd25
font_01_sfnt_off00005f4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F4C 19224 bytes
SHA-256: 1450c73ff2841b29e880c9312e7ecd202d94fc5fb63b7091b074e72c897c6baa

Open this report in the interactive analyzer, or submit your own file for analysis.