PDF static analysis report

Static analysis result for SHA-256 e158848a78b5f8c2…

SUSPICIOUS

PDF

44.7 KB Created: 2021-06-10 17:46:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 96854127535efaef83245d0bea5dd897 SHA-1: 5202db89790bcc2a2bb8529b376532c1251ac812 SHA-256: e158848a78b5f8c24996ad2e102a63924cf9bd8e10b35d2ca4b7d75e5406063d
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and text that lure users with promises of 'free Robux' and 'game hacks'. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests an attempt to redirect users to malicious content. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-free-robux-generator-2021-game-hack PDF link annotation
    • http://library.thamrin.ac.id/repository/hacks-for-bit-slicer-roblox_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/coin-master-hacking-news_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/free-spins-coin-master-twitter_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/lazy-blocks-com-free-robux_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/robux-free-promo-codes_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/free-coins-coin-master_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/coin-master-cheats-without-verification_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/free-robux-discord-servers_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/coin-master-free-gifts_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/coin-master-free-download-app_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/free-spin-coin-master-2021-link_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/hack-spin-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/orewards-com-free-robux_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/cheat-codes-on-xbox-one-for-roblox_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/minecraft-hacked-client_GM479516143.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/coin-master-free-spins-2021-haktuts_GM406889139.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/free-minecraft-texture-packs_GM479516143.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/www-robux-com_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/robuxian-free-robux_GM431946152.pdfIn PDF document text
    • http://library.thamrin.ac.id/repository/free-robux-sites-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005141.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5141 25052 bytes
SHA-256: 39fbaeca3c19a92cfa8c37ec9ca7d136d3205797b4b1e0f2d07e20636d6111b7
font_01_sfnt_off00008a6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A6F 18820 bytes
SHA-256: 5d2ead64db0ad31ca207c531fb8d23bcdb6cf67dcd84beac16e01571736fb436

Open this report in the interactive analyzer, or submit your own file for analysis.