PDF static analysis report

Static analysis result for SHA-256 bb3aba0fc6730c37…

SUSPICIOUS

PDF

48.1 KB Created: 2021-06-14 00:21:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: c7d111c719bbc75a571d932b55b2d3a0 SHA-1: d69096bce83068c4a6a678fbc8ca06e724deb934 SHA-256: bb3aba0fc6730c371f0f65e90c66a33fa7a1909ea5108effa84bf1d1dd82c0c4
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains multiple embedded URLs and a call-to-action lure related to game cheats and hacks, suggesting a phishing or malware distribution attempt. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the document's theme strongly indicate an attempt to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-get-free-wings-in-roblox-2021-may-game-hack PDF link annotation
    • http://smpn1sda.sch.id/slims/repository/coin-master-spins_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/hurt-roblox-hack_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/coin-master-hack-apk_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/free-coin-and-spin-for-coin-master_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/drifitng-simualtor-roblox-hack_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/roblox-mobile-hack_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/roblox-hack-ios_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/how-to-hack-roblox-accounts-on-mobile-2021_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/coinmaster-spins_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/coin-master-hacks-no-verification_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/free-spins-coin-master-links-2021_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/coin-master-hack-cheat-engine_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/how-to-get-free-robux-without-doing-anything_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/how-to-get-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/robux-hack-no-download-2021_GM431946152.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/free-minecraft-mods-for-ps4_GM479516143.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/minecraft-free-download-unblocked_GM479516143.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/free-spin-coin-master-2021-link_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/master-free-spin-and-coin-links-html-m-1_GM406889139.pdfIn PDF document text
    • http://smpn1sda.sch.id/slims/repository/free-roblox-arsenal-hack-executor_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000049fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x49FC 25780 bytes
SHA-256: 57880d212aa9d9c23ff78ef5d52fdae2cf487e77df6b0bb41e79ef5e0096bd26
font_01_sfnt_off000084a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84A5 4660 bytes
SHA-256: b8980cdac4d025496d9fe039d8c05bb5b9bae1b804244a1f9c05e9663db72816
font_02_sfnt_off000094b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x94B6 19828 bytes
SHA-256: 9b980e43b531070ce4cfa9676ff16359a9bef38f228917c953693cfc027818b7

Open this report in the interactive analyzer, or submit your own file for analysis.