PDF static analysis report

Static analysis result for SHA-256 d2aec6993969635d…

SUSPICIOUS

PDF

44.2 KB Created: 2021-06-13 23:10:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 113de60c5bfdc4c824920e96b90e1f65 SHA-1: bad8ae8e82a9c331a982f7c7e8ebb16cf41ba685 SHA-256: d2aec6993969635dd3422569b3c49302ebca8519dd829b36da2df1b6de215e75
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains an external URI pointing to a download link for 'Roblox Jailbreak hacks', indicating a lure for potentially malicious software. The ML classifier strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the lure suggest an attempt to trick users into downloading and executing a secondary payload, likely related to game cheating or malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/774-hack-roblox-jailbreak-game-hack PDF link annotation
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/how-to-get-hacks-for-roblox-fallen_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/guest-shirt-roblox-free_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/free-robux-no-human-verification-or-survey-2021_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/roblox-gear-hack-cheat-engine_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/minecraft-building-hacks_GM479516143.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/roblox-accounts-for-sale-free_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/free-dominus-userscriptorg-roblox_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/ben-10-roblox-cheats_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/roblox-giving-away-free-robux_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/best-roblox-games-to-hack-on_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/free-robux_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/roblox-money-hack-for-rocitizens_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/help-im-being-cheated-on-by-some-roblox-girls_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/roblox-shirts-free-girl_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/how-to-get-admin-in-roblox-for-free_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/free-red-scarf-roblox_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/roblox-email-cheat_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/how-to-find-free-items-in-roblox-catalog_GM431946152.pdfIn PDF document text
    • https://willemvanromburgh.co.za/wp-content/uploads/fsqm-files/www-roblox-com-download-free_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004d46.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4D46 25660 bytes
SHA-256: 3ca1b11b18dfe8f30a4f5f9b00fcb944e90fabb532a1f0599625fc70a3ea39db
font_01_sfnt_off00008989.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8989 18588 bytes
SHA-256: 1fbcb4f0900916f7a01c8fe2d9ac589754b2472837b25d91745512d5511d82fc

Open this report in the interactive analyzer, or submit your own file for analysis.