PDF static analysis report

Static analysis result for SHA-256 e33c747967eb79f0…

SUSPICIOUS

PDF

44.6 KB Created: 2021-04-03 05:48:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 84a0c42f8f2dfc090ec8011942909e87 SHA-1: b4fb27dd199612829c3cd2d9ea3d3f73dd8a5752 SHA-256: e33c747967eb79f0f29b34be0a0db01423e1ae51d9c9c9dcc27cc999dbcd5e67
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as suspicious by an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9434

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-accounts-to-hack-on-roblox PDF link annotation
    • https://gomsa.nl/images/free-roblox-accounts-with-robix.pdfIn PDF document text
    • http://echosvoix.ch/images/how-to-spped-hack-on-roblox-jailbreak.pdfIn PDF document text
    • https://www.air-shop.cz/images/how-to-get-free-robux-2021-to-2021.pdfIn PDF document text
    • https://socialvalue.gr/images/mobile4free24-24com-roblox-free-robux.pdfIn PDF document text
    • https://www.audev.com/images/roblox-codes-to-get-free-stuff-2021.pdfIn PDF document text
    • http://www.awakeningtruth.org/images/get-wall-hacks-in-roblox.pdfIn PDF document text
    • http://www.evaplast.by/images/how-to-get-free-obc-and-robux.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/roblox-hack-de-robux-2021.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/roblox-free-cat-tail.pdfIn PDF document text
    • http://www.exikom.com.ua/images/hack-boku-no-hero-academia-roblox-espaol.pdfIn PDF document text
    • http://nosocomium.rv.ua/images/robux-hack-guaranteed-no-survey-or-human-verification.pdfIn PDF document text
    • https://www.udivadlahotel.cz/images/how-to-get-free-robux-in-1-minute.pdfIn PDF document text
    • http://escolaarboc.cat/images/free-roblox-photoshop-apps.pdfIn PDF document text
    • https://www.hotschool.com.au/images/roblox-hack-week-video.pdfIn PDF document text
    • https://www.iadh.bi/images/roblox-robux-hack-download-2021.pdfIn PDF document text
    • http://sscclc.edu.ec/images/robux-hack-no-human-verification-no-download.pdfIn PDF document text
    • http://iluvlocalplaces.com/images/roblox-free-download-apk.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/robux-hacks-that-acctualuy-work-for-everyone-on-roblox.pdfIn PDF document text
    • http://www.hawler.in/images/free-robux-hack-us.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/roblox-valentine-generator-free-robux.pdfIn PDF document text
    • http://hemmet-strand.dk/images/pocket-pirates-roblox-cheat.pdfIn PDF document text
    • http://www.web.stc-part.co.th/images/free-roblox-promo-codes-december-2021.pdfIn PDF document text
    • https://www.udivadlahotel.cz/images/roblox-cheat-engine-63-codes.pdfIn PDF document text
    • http://www.web.stc-part.co.th/images/roblox-girl-hair-free.pdfIn PDF document text
    • https://reggieslockandkey.com/images/how-to-look-like-naruto-in-roblox-for-free.pdfIn PDF document text
    • http://legs11.co.za/images/roblox-bee-swarm-simulator-cheats.pdfIn PDF document text
    • https://www.fhccu.com/images/best-free-level-7-executor-free-for-roblox-2021-august.pdfIn PDF document text
    • https://www.hotschool.com.au/images/roblox-rust-free.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/hawt-sauce-hack-roblox.pdfIn PDF document text
    • http://agrao.in/images/haw-to-get-free-stuff-roblox-march-2021.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/free-robuxs-games-no-scam.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/robux-hack-generator-no-veriy.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/fake-hacker-in-roblox.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/free-robux-generator-no-ads-or-surveys.pdfIn PDF document text
    • http://behsanroshd.com/images/free-robux-for-nothing.pdfIn PDF document text
    • https://www.albisser.ch/images/how-to-get-free-money-roblox-jailbreak.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/how-to-hack-project-pokemon-roblox.pdfIn PDF document text
    • https://technospektr.com.ua/images/free-roblox-noclip-hack-no-download.pdfIn PDF document text
    • https://www.saisystem.it/images/fortnite-br-roblox-hack.pdfIn PDF document text
    • https://pa-waingapu.go.id/images/hacked-google-roblox-pacifico-2.pdfIn PDF document text
    • https://www.millatgears.com/images/my-roblox-account-got-hacked-flamingo.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/set-hack-robux.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/roblox-one-piece-millenium-hack-devil-fruit.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/hakarian-roblox-hack.pdfIn PDF document text
    • http://www.drent.se/images/rexgg-free-robux.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/roblox-pizza-hack.pdfIn PDF document text
    • http://www.boic.nl/images/roblox-custom-free.pdfIn PDF document text
    • http://www.fluidtech.hu/images/free-card-robux.pdfIn PDF document text
    • http://behsanroshd.com/images/hack-boku-no-roblox-remastered.pdfIn PDF document text
    +2 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000570f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x570F 22916 bytes
SHA-256: a719e93a20520527b29468954d6c95a02b9fc987d421d9dd9054219e264f54ac
font_01_sfnt_off00008984.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8984 18316 bytes
SHA-256: 105ff0f37fee60e587ac0f14f0bc226233b48271097ee258ed240d3d31f23298