PDF static analysis report

Static analysis result for SHA-256 bdbf60ca57e6472d…

SUSPICIOUS

PDF

48.3 KB Created: 2021-05-12 05:33:36 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 1fdc8460b0be5eadf232e4499a36e6bf SHA-1: ea32c44f69f11e72e80a95ce8bea46d3950aba13 SHA-256: bdbf60ca57e6472dc0c6bea752f147d1665cce035d0456ccbb3d036f425898d1
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple URLs pointing to sites offering game hacks and generators, disguised as a lure for free Robux. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs suggests an attempt to redirect users to download further malicious content. No scripts were extracted, but the overall pattern indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-generator-no-human-verification-or-survey-2021-game-hack PDF link annotation
    • https://sisomdethospital.com/ckfinder/userfiles/files/coin-master-hack-online-download_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/coin-master-hack-tool-ios_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/how-to-get-more-robux-for-free_GM431946152.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/free-robux-codes-generator-no-verification_GM431946152.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/free-roblox-shirt-templates-2021_GM431946152.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/free-robux-hack_GM431946152.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/no-human-verification-hack-for-coin-master_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/how-to-get-free-spins-and-coins-on-coin-master_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/clients-minecraft_GM479516143.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/free-roblox-gfx_GM431946152.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/how-to-get-free-gold-cards-on-coin-master_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/minecraft-survival-hacks_GM479516143.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/coin-master-free-spin-link-app_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/coin-master-hack-with-facebook-login_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/100-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/coin-master-free-spins-2021-link_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/download-coin-master-apk-hack_GM406889139.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/is-minecraft-free_GM479516143.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/robux-free-2021_GM431946152.pdfIn PDF document text
    • https://sisomdethospital.com/ckfinder/userfiles/files/how-to-get-free-robux-not-a-scam_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004e2c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E2C 31380 bytes
SHA-256: 32111fa0db10e5bc4b17c087814f3fc746fdbc037f90644ca28bff79b4a891b2
font_01_sfnt_off000096ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x96EC 19556 bytes
SHA-256: 3a60cdb248c638d1e974f8488a9d0c49865e0dbecbd8cc682acbe36144e2e86e

Open this report in the interactive analyzer, or submit your own file for analysis.