PDF static analysis report

Static analysis result for SHA-256 d5e962c07945ce1b…

SUSPICIOUS

PDF

33.2 KB Created: 2021-04-03 22:40:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 03d54815abb61f07baf86900746e66de SHA-1: 64283935ee4f3da494b1fd0af4f73a7b400059c7 SHA-256: d5e962c07945ce1bad1ec501f40373ffd15cd4d530c689749b39eb9e8a457852
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as suspicious by an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-hack-into-roblox-accounts-on-android PDF link annotation
    • http://energotestcontrol.ru/images/como-hackear-grand-crossing-2021-roblox.pdf%0AIn PDF document text
    • https://www.air-shop.cz/images/roblox-points-get-free-robux.pdf%0AIn PDF document text
    • http://aeroclub-kaernten.at/images/roblox-free-wings-in-catalog.pdf%0AIn PDF document text
    • https://estalagemmonteverde.com.br/images/roblox-twitter-hacked.pdf%0AIn PDF document text
    • http://eltisstudio.sk/images/press-a-button-and-get-free-robux.pdf%0AIn PDF document text
    • http://www.eurologistiki.gr/images/hack-rc7-roblox-download.pdf%0AIn PDF document text
    • https://www.milewood.co.uk/images/horse-valley-beta-roblox-maze-cheat.pdf%0AIn PDF document text
    • https://www.seeingindependence.org/images/free-robux-app-ios.pdf%0AIn PDF document text
    • http://www.lovecraftiana.com.ar/images/free-designs-for-streamers-roblox.pdf%0AIn PDF document text
    • https://www.romedia.gr/images/termianl-railway-roblox-hack.pdf%0AIn PDF document text
    • https://www.cpnf.ch/images/free-5-million-robux.pdf%0AIn PDF document text
    • https://www.iadh.bi/images/seraph-roblox-download-free.pdf%0AIn PDF document text
    • http://uctovnictvosnv.sk/images/how-to-get-free-robux-no-verification-no-survey.pdf%0AIn PDF document text
    • https://www.sitiwebjoomla.it/images/discord-roblox-hacks.pdf%0AIn PDF document text
    • http://www.nielsen2u.dk/images/roblox-btools-hack-2021-download.pdf%0AIn PDF document text
    • http://www.hawler.in/images/how-to-hack-roblox-accounts-with-roblosecurity.pdf%0AIn PDF document text
    • http://www.vktzunami.cz/images/how-to-get-robux-no-hack-or-anything-free-209.pdf%0AIn PDF document text
    • http://www.boic.nl/images/how-to-hack-your-robux.pdf%0AIn PDF document text
    • https://pemadamapi.net/images/roblox-robux-hack-generator-no-survey-2021.pdf%0AIn PDF document text
    • https://ballaratcaravans.com.au/images/free-roblox-private-server.pdf%0AIn PDF document text
    • http://www.cosver.nl/images/gear-hack-roblox.pdf%0AIn PDF document text
    • https://gaj.rs/images/how-to-get-free-robux-without-human-verification-on-ipad.pdf%0AIn PDF document text
    • https://www.cosmosdawn.net/images/free-roblox-accounts-2021-august.pdf%0AIn PDF document text
    • http://bilhetim.com.br/images/is-it-easy-to-hack-on-roblox.pdf%0AIn PDF document text
    • http://safwafurniture.com/images/baby-hacks-in-adopt-and-raise-a-baby-in-roblox.pdf%0AIn PDF document text
    • http://www.htc.edu.au/images/robux-hack-no-verification-human.pdf%0AIn PDF document text
    • http://www.kalaaliaraq.dk/images/8-bit-speed-hack-roblox.pdf%0AIn PDF document text
    • https://www.abrapppe.org.br/images/hackear-cuentas-de-roblox-2021.pdf%0AIn PDF document text
    • https://www.hbproducts.dk/images/hack-clients-for-roblox-youtube.pdf%0AIn PDF document text
    • http://learningarabic.co.uk/images/cheat-roblox-blox-piece.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00003474.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003474.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3474 19368 bytes
SHA-256: 3bdc8e9aec603d9fd2651194fc6fdabe83c1b2056cbf020eca716f44a2b65a63
font_01_sfnt_off00005d56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D56 18484 bytes
SHA-256: c1f5316eaf57215e66da3a4f9b11abbaa240e691f1c64ee3073e54e6fb399d90