PDF static analysis report

Static analysis result for SHA-256 dbef56ba8f5d2ab6…

SUSPICIOUS

PDF

38.9 KB Created: 2021-06-25 13:42:56 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4431b786fd5e3ee1cba9facc8f5f6795 SHA-1: ed896e0a927d2c0bb2fd134e862243843a415e75 SHA-256: dbef56ba8f5d2ab637697ef48c9ce7af79d4c9bbdcfc1c4659b5af6ceb6daf68
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a prominent URL and text related to obtaining free Robux, a common lure for scams. The ML classifier strongly flagged this PDF as malicious. While no scripts were directly extracted, the presence of an external URI and the document's content suggest it's designed to redirect users to a potentially harmful website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-get-free-robux-without-human-verification-game-hack PDF link annotation
    • https://limebug.com/media/storage/editor/files/how-to-get-free-coins-in-mcpe-master_GM406889139.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/how-to-get-stuff-that-cost-coins-free-mcpe-master_GM406889139.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/master-coin-hack-game_GM406889139.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/microsoft-roblox_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/free-robux-scam_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/how-to-cheat-roblox-jailbreak-2021_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/mcpe_GM479516143.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/mac-roblox-cheat-engine_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/how-can-u-get-free-robux_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/free-to-play-minecraft-servers_GM479516143.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/free-robux-images_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/roblox-comroblox_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/minecraft-online-free-download_GM479516143.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/best-free-spins-link-coin-master_GM406889139.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/how-to-make-hacking-scripts-in-roblox_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/how-to-get-free-robux-on-pc_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/https-webrobloxknife-simulatorcom-games-202120218-howtogetfreerobux_GM431946152.pdfIn PDF document text
    • https://limebug.com/media/storage/editor/files/roblox-lumber-tycoon-2-hack-pastebin_GM431946152.pdfIn PDF document text
    • https://www.roblox.com/.IIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E35 22780 bytes
SHA-256: 47170110c483c60d0a1aefd72d1aaf099cbc5e4bddc6bd751755e0fed022f153
font_01_sfnt_off00007124.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7124 19860 bytes
SHA-256: 495fe8ab67ccc92980b130970b14ca59a4055a895de5252c8ccba287623abf67

Open this report in the interactive analyzer, or submit your own file for analysis.