PDF static analysis report

Static analysis result for SHA-256 bae89539ac844551…

SUSPICIOUS

PDF

48.8 KB Created: 2021-06-10 13:33:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: feb4ca1a706a18f161951580ec4e52a6 SHA-1: 668fa9531eb68de8b300ec72004bc397fbb645ce SHA-256: bae89539ac844551d35a6601cda5d2b42cc628c3081abe7bc7da32c047ed5b59
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs, with one prominent URL pointing to a resource related to 'roblox virus game hack'. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the lure of free game items suggest an attempt to trick the user into downloading a second-stage payload, likely via a malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-models-roblox-virus-game-hack PDF link annotation
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/make-robux-free-robux-2021_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/free-robux-discord_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/roblox-hacker-egg_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/roblox-free-robux-hack_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/free-robux-on-ipad_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/how-to-get-the-rarest-item-on-roblox-for-free_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/free-roblox-accounts-with-builders-club-2021_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/free-robux-script-2021_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/hack-speed-vehicle-simulator-roblox_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/rbx-heaven-free-robux_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/minecraft-games-free-download_GM479516143.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/robux-hack-tools_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/roblox-jailbreak-money-hack-download-free_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/free-robux-no-download_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/free-robux-games-that-actually-work_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/roblox-apocalypse-rising-hack-script_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/will-minecraft-dungeons-be-free_GM479516143.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/arpirl-fools-roblox-hack_GM431946152.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/coin-master-free-spins-and-coins-today-gift-reward_GM406889139.pdfIn PDF document text
    • https://www.awwda.go.ke/wp-content/uploads/fsqm-files/how-do-u-get-free-robux-witout-payig_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000522f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x522F 25604 bytes
SHA-256: c692b77596a41be7a3d0ba92e438de08460b779e1dbbf00de94153925f4d0c79
font_01_sfnt_off00008d9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D9E 5696 bytes
SHA-256: 450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139
font_02_sfnt_off00009ab0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9AB0 18712 bytes
SHA-256: 8ad497cbe3ad639d52456ed7d16b9d8f3cf82d1df85cc9503f7989361b9ec177

Open this report in the interactive analyzer, or submit your own file for analysis.