PDF static analysis report

Static analysis result for SHA-256 d83e5298fab6fdf8…

SUSPICIOUS

PDF

36.1 KB Created: 2021-06-28 22:23:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: e69b2db517d0f6d85e5db745c2d00e0a SHA-1: 15dea43cb52727333d9a4f0024a9c8cad8bd2b1d SHA-256: d83e5298fab6fdf82662e9269cf6d9e9fd39b0ab2bd4b12b0323f0638ca8e2bf
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains numerous URLs and a call-to-action phrase, strongly suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence. The embedded URLs point to sites offering game hacks and currency, which are common lures for malware distribution. No scripts were extracted, but the presence of external URIs and the ML classification indicate a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-get-free-builders-club-and-robux-game-hack PDF link annotation
    • http://perpus.fisip.unnur.ac.id/repository/free-robux-games_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/free-account-robux-roblox_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/coin-master-unlimited-spin-hack_GM406889139.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/free-mods-for-coin-master_GM406889139.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/hacks-para-todos-los-juegos-de-roblox_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/free-robux-generator-online-no-survey-scratch-studio_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/free-uc-on-roblox_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/daily-coin-master-free-spin-link_GM406889139.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/free-robux-generator-for-roblox-2021_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/roblox-hack-mod-windows-7_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/animation-roblox-free_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/get-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/roblox-lumber-tycoon-2-cheat-money_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/how-o-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/tiktok-free-iphone-12_GM835599320.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/noclip-hack-roblox-jailbreak_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/free-minecraft-hosting_GM479516143.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/get-free-robux-gg_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/roblox-hacks-on-computer-2021_GM431946152.pdfIn PDF document text
    • http://perpus.fisip.unnur.ac.id/repository/free-spins-and-coins-com_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000032d2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32D2 23264 bytes
SHA-256: f8cdc732e8c6c9893935e43bdc88e6b0009fb187ebf4fcfa442876f9882e3b70
font_01_sfnt_off00006729.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6729 19352 bytes
SHA-256: 2827f22f0df93785848761e4de1519b68b0d5e63566a1969119126d2d2367e6b

Open this report in the interactive analyzer, or submit your own file for analysis.