PDF static analysis report

Static analysis result for SHA-256 e03497f27047884a…

SUSPICIOUS

PDF

34.8 KB Created: 2021-07-05 23:56:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: c2392a872beed296fa50c291c877928d SHA-1: 38c4c753887abfabae3167da416e98f64f6f41a6 SHA-256: e03497f27047884a51f741a4f1c4327fcd70292048bb886cd975866449f5091b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a visual download button lure, strongly suggesting an attempt to trick the user into downloading a secondary payload. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of external URIs and the overall structure indicate a malicious intent to deliver further content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/military-simulator-roblox-hacks-game-hack PDF link annotation
    • http://www.stttekstil.ac.id/elib/repository/free-wallpapers-for-roblox-fps-games_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/robux-2021-free_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/unlimited-gameing-hacks-roblox-generator_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/free-coin-master-spins-blog_GM406889139.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/free-roblox-blue-hair-com_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/coin-master-free-link-spin_GM406889139.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/cheat-roblox-retail-tycoon-2021_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/how-to-earn-robux-fast_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/huong-dan-tai-hack-roblox_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/coin-master-gold-cards-free_GM406889139.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/free-robux-reddit_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/coin-master-free-spins-and-coins-2021_GM406889139.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/free-robux-events_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/how-do-you-hack-micah-on-roblox_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/how-to-get-free-easy-robux-vortexx_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/hacker-fedora-roblox_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/download-roblox-hack-pc-vehicle-simulator_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/rbx-free-robux_GM431946152.pdfIn PDF document text
    • http://www.stttekstil.ac.id/elib/repository/coin-master-hack-ios-download_GM406889139.pdfIn PDF document text
    • https://www.roblox.com/.IIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003124.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3124 22024 bytes
SHA-256: 2365083d1bad3ebaad8a47ebb1ec7407a75c5355172481074e3d8158b1cd2133
font_01_sfnt_off000061e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61E4 19468 bytes
SHA-256: 7e048caaffa17115eb2d7ace3849457f462ba319a3acc0f450439aedf87fe7bb

Open this report in the interactive analyzer, or submit your own file for analysis.