PDF static analysis report

Static analysis result for SHA-256 dc0ebbbe1fe0b445…

SUSPICIOUS

PDF

44.2 KB Created: 2021-04-24 22:11:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 8bdf74c6c0204776caeafd36f3ca9526 SHA-1: 1800d92c9f3cae82b8b6d6a8573a3a29a158bd97 SHA-256: dc0ebbbe1fe0b44593ab4024c7c34aa48c32c74c1d169a3e584abe51d2b3bc07
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple links to external resources, including one identified as a potential hack generator. The ML classifier strongly flagged this PDF as malicious, and the presence of a 'CLICK HERE TO ACCESS ROBLOX GENERATOR' call-to-action reinforces the lure. While no scripts were explicitly extracted, the embedded URLs suggest an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9868

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/anime-tycoon-hack-roblox-game-hack PDF link annotation
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/how-to-kill-anyone-in-roblox-hacks-v3rmillion.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/counter-blocks-roblox-offensive-hacks-unknowncheats.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/free-roblox-jailbreak-vip-server.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/roblox-free-skin-color.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-m-robux.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/free-robux-no-human-verification-no-survey-pc.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/free-robux-ios.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/roblox-sharkbite-free-boats-script.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/noclip-script-roblox-hack.pdfIn PDF document text
    • https://www.dikes.badungkab.go.id/new/public/ckfinder/userfiles/files/free-robux-and-tix-no-human-verification.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000429f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x429F 26576 bytes
SHA-256: be13a13205c1496c3411489377443b699610d774d56ac61582daba7c55f908cd
font_01_sfnt_off00007fd9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FD9 2848 bytes
SHA-256: 4737c2778a085e0cb49e73f3b054b1a71e3f40720d213b4bfda97f95a31bfbf1
font_02_sfnt_off0000899a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x899A 18740 bytes
SHA-256: 106ef04840ec0af6fdff3c74c3b7b0cdb4f8981fae39fd9008fcca10fba2fbdc

Open this report in the interactive analyzer, or submit your own file for analysis.