PDF static analysis report

Static analysis result for SHA-256 e180791e57b20981…

SUSPICIOUS

PDF

46.2 KB Created: 2021-06-11 09:35:17 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 25ef5a48bf7c6492a443aeccf648ef82 SHA-1: 5777b2f61173f26e8207f202cd0a6d56f37eabdb SHA-256: e180791e57b2098149deca6d3103c300b7964679bdd2cd7f7b4cc0b61fbbca20
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple URLs pointing to sites offering game cheats and hacks, specifically for Robux. The ML classifier flagged this PDF as malicious with high confidence. The presence of embedded URLs and the document's theme suggest it is a lure to download further malicious content, likely related to game exploits or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-robux-no-virus-hax-free-game-hack PDF link annotation
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/roblox-shionbi-life-max-lvl-hack_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-coin-master-spins_GM406889139.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-roblox-shirt-templates-free-shipping_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/minecraft-online-free-no-download_GM479516143.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/how-to-get-free-robux-without-verifying-2021_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/rob-hacker-robux-generator_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/how-to-get-free-robux-in-roblox-2021_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/minecraft-life-hacks_GM479516143.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/roblox-hacked-com-2021_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/play-minecraft-for-free_GM479516143.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/cocaine-roblox-hack_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/roblox-how-to-get-car-crushers-2-for-free_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/im-gonna-hack-roblox_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/nev-roblox-hack-exploit_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-mobile-360-free-robux_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/enter-the-code-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/robux-hack-me_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/mobihack-net-roblox-hack_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/hacks-for-boku-no-legacy-alpha-2xexp-roblox_GM431946152.pdfIn PDF document text
    • https://altaviastagerace.it/wp-content/uploads/fsqm-files/how-to-buy-free-robux-using-inspect_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000052a3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x52A3 26964 bytes
SHA-256: 4ff0a8406ffc9a75b7cdc9ad67696cb1b9752ae8ba7b206ec55cb57657db5cd5
font_01_sfnt_off00009178.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9178 18496 bytes
SHA-256: 1910ce0d9a802cf80aec70ea98c0ffedff76aa743387a0aedfe4ecf623ddab48

Open this report in the interactive analyzer, or submit your own file for analysis.