PDF static analysis report

Static analysis result for SHA-256 bfaf5d3c5bfd4a5e…

SUSPICIOUS

PDF

79.1 KB Created: 2021-05-15 14:10:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 114bf89963435bda1e738c4e94fd79b3 SHA-1: 4e4899d84051cdd8f6cf34dd750cfed59e70a7ba SHA-256: bfaf5d3c5bfd4a5ed483ba0d9fc000258fc642dc40c9cefc7f4fdd519a954d82
52 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a prominent link disguised as a game hack generator. This lure, combined with the presence of embedded URLs and a 'download button' heuristic, strongly suggests a phishing or malware distribution attempt. The primary URL identified is likely the initial landing page for a malicious campaign.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3598

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-for-offers-game-hack PDF link annotation
    • http://wadimor.co.id/media/imagesfiles/coin-master-hack-without-downloading-apps_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coin-master-free-spin-link-today-2021_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/john-doe-roblox-hacker_GM431946152.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/free-robux-no-verify-2021_GM431946152.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coin-master-hack-ios-reddit_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coin-master-fan-page-free-spins_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/blox-rewards_GM431946152.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/how-to-get-free-minecraft-skins_GM479516143.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coin-master-free-cards-link-2021_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coin-master-gold-cards-free-link_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/free-dominus-roblox_GM431946152.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/free-op-minecraft-servers_GM479516143.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/minecraft-alt-accounts-free_GM479516143.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/free-coins-and-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coin-blogspot_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/free-robux-without-any-verification_GM431946152.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/roblox-phantom-forces-hack_GM431946152.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coin-master-free-spins-daily-link-game-mod_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/coinmaster-hack_GM406889139.pdfIn PDF document text
    • http://wadimor.co.id/media/imagesfiles/how-do-u-hack-roblox_GM431946152.pdfIn PDF document text
    • http://192.168.0.99/%20%3Cp%3E%3Cp%3ERoblox%20bee%20swarm%20simulator%20codes%20:%20Roblox%20Toy%20Codes%202021.%20Today%20Outrageous%20Builders%20Club%20Membership%20for%20only%20$19.95%20Per%20Month.%20Sign%20Up%20for%20Roblox%20Email%20Newsletters%20and%20Receive%20Exclusive%20News%20and%20Updates.%20400%20Robux%20for%20only%20$4.95%20:%20Promo%20Codes%20That%20Work%20Roblox%20May%202021.%3Cp%3E%3Cp%3EBest%20Way%20to%20Get%20Free%20Robux%20Free%20Robux%20are%20very%20easy%20to%20get%20with%20this%20powerful%20generator.%20The%20only%20thing%20you%20have%20to%20do%20is%20to%20choose%20your%20robux%20quantity%20for%20your%20username,%20and%20wait%20for%20the%20generator%20to%20create%20the%20resources%20for%20you.%20How%20is%20This%20Possible%3Cp%3E%3Cp%3Edownload%20roblox%20cheat%20tool%3Cp%3E%3Cp%3EA%20simple%20roblox%20hack%20script,%20took%203%20days%20to%20make,%20if%20you%20wanna%20copy%20some%20of%20my%20work,%20Please%20credit%20me!%20if%20userdownload==script%20then%20goto%20thanks%20end%20::%20thanks::%20gg.alertIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000d2ab.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD2AB 24488 bytes
SHA-256: 93f87536d7c91837c555dc832b1cacf305ac058259f80ac4148d08dc9a40501c
font_01_sfnt_off00010ae6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AE6 2984 bytes
SHA-256: 889cfc2fd0afa9ea114d6666204c6ce0548d0aae2cba345827d317498c4c06bc
font_02_sfnt_off00011512.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11512 18012 bytes
SHA-256: 278bb2adf081b3d64a56d83d4f350a46dc6f9587b97b13dd55da789f3c3fc8ad

Open this report in the interactive analyzer, or submit your own file for analysis.