PDF static analysis report

Static analysis result for SHA-256 bcc86afa3e0c7270…

SUSPICIOUS

PDF

31.9 KB Created: 2021-07-21 11:31:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: cc8dc53ae542650d7ae2a5d3e2d2ae04 SHA-1: 8a96d22c108ec9872a933a6da653338b6c28001a SHA-256: bcc86afa3e0c72703a7ad02af722b2607a87360272fb0e7cd23adf9bf4614b8a
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains multiple embedded URLs and a prominent call-to-action for a 'Robux Generator', strongly suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of external links and the lure of 'free Robux' indicate a likely attempt to redirect users to a malicious website for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9900

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-robux-scams-game-hack PDF link annotation
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-cards_GM431946152.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/coin-master-daily-free-spins-link_GM406889139.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/minecraft-realms-free-trial_GM479516143.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/minecraft-java-edition-free-trial_GM479516143.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/free-roblox-accounts-with-robux_GM431946152.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/robux-hack-2021_GM431946152.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/get-minecraft-windows-10-free_GM479516143.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-download-minecraft-for-free-on-mac_GM479516143.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/how-can-i-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • https://hundt-druck.de/wp-content/uploads/fsqm-files/coin-master-free-coins-and-spins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000271f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x271F 22572 bytes
SHA-256: 03948581bdd59169f85213e9758d0928a319d0fd3178bf89b09ee97e1b789e59
font_01_sfnt_off0000596a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x596A 18688 bytes
SHA-256: b778a3c2a99961d14742e517d070f3eb9b56258bc2372469447924e166dcdd4d

Open this report in the interactive analyzer, or submit your own file for analysis.