PDF static analysis report

Static analysis result for SHA-256 eabad0f7da933e6b…

SUSPICIOUS

PDF

58.7 KB Created: 2021-04-05 18:55:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 0ac3e8e4cc5957b11fd326b092c8c31c SHA-1: 44a0cea9075c6a45103b991f112aa2260096b143 SHA-256: eabad0f7da933e6b1bcb19433df2d88ec28fc68cdde15f18443ed67c1f3b172f
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as suspicious by an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/all-ways-to-get-free-robux PDF link annotation
    • http://bit-sky.com/images/free-robux-accounts.pdfIn PDF document text
    • http://shahriyarclimb.com/images/cheat-roblox-speed-simulator.pdfIn PDF document text
    • http://cosver.eu/images/free-catalog-items-roblox-2021.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/cheat-engine-roblox-dbor.pdfIn PDF document text
    • http://www.ntc.edu.za/images/how-to-get-free-admin-on-any-roblox-game-2021.pdfIn PDF document text
    • http://optiquedelavaunage.com/images/https-www-roblox-com-games-2021202180-free-admin.pdfIn PDF document text
    • http://firstaidacademy.be/images/free-robux-pin-codes-2021.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/free-robux-obby-june-2021.pdfIn PDF document text
    • https://www.hbproducts.dk/images/how-to-hack-someone-in-roblox-2021.pdfIn PDF document text
    • http://www.awakeningtruth.org/images/cheat-code-farming-simulator-roblox.pdfIn PDF document text
    • http://www.teapotjewelry.com/images/roblox-games-unblocked-free.pdfIn PDF document text
    • http://kids-academy.pl/images/how-to-make-a-free-model-on-roblox.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/roblox-park-forest-free.pdfIn PDF document text
    • http://www.hawler.in/images/kill-all-prison-life-roblox-hack-script.pdfIn PDF document text
    • http://ff-klaffenbach.de/images/scpninetailedfox-mod-cheats-roblox.pdfIn PDF document text
    • http://energotestcontrol.ru/images/free-codes-for-robux-2021.pdfIn PDF document text
    • http://santjoandelesabadesses.cat/images/como-hackear-cuentas-de-roblox-sin-necesidad-de-contrasea.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/free-robux-gft-cards.pdfIn PDF document text
    • http://sealysports.com/images/youtube-how-to-hack-robux-within-a-couple-of-secound.pdfIn PDF document text
    • http://www.hotelcimone.it/images/roblox-gui-hack-pastebin.pdfIn PDF document text
    • http://lillysonthelake.com/images/roblox-infinite-jump-hack-download-2021.pdfIn PDF document text
    • http://osteonad.com/images/redeem-roblox-cards-free-codes-2021.pdfIn PDF document text
    • http://alexanderautos.co/images/roblox-prison-life-hack-script.pdfIn PDF document text
    • http://shiny-nn.ru/images/roblox-cheat-engine-youtube.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/roblox-script-hack-pizza-factory.pdfIn PDF document text
    • http://rumler.pl/images/stella-roblox-hack-buy.pdfIn PDF document text
    • http://grand-ural74.ru/images/cool-free-outfits-on-roblox.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/flameggco-free-robux.pdfIn PDF document text
    • https://estalagemmonteverde.com.br/images/hacks-for-robux-for-roblox.pdfIn PDF document text
    • http://iricamidelcuore.it/images/roblox-free-robux-no-human-verification-2021.pdfIn PDF document text
    • http://vagency.us/images/get-free-items-roblox-pastebin.pdfIn PDF document text
    • https://liceucastrodelapenya.com/images/roblox-simulator-hack.pdfIn PDF document text
    • http://only1you.ru/images/how-to-get-free-robux-for-robloxroblox-corporation.pdfIn PDF document text
    • http://www.fanciullovito.it/images/quelqun-me-hack-sur-roblox-city.pdfIn PDF document text
    • http://fabianslaw.org/images/roblox-hack-download-pc-free.pdfIn PDF document text
    • http://columbuscigar.com/images/roblox-how-to-make-a-game-thumbnail-for-free.pdfIn PDF document text
    • https://www.stkdb.cz/images/www-bloxy-world-robux-free.pdfIn PDF document text
    • http://fiur-malermeister.de/images/haw-to-get-free-stuff-roblox-march-2021.pdfIn PDF document text
    • https://www.olboys.it/images/how-to-get-free-outrageous-and-robux-20-seconds.pdfIn PDF document text
    • http://learningarabic.co.uk/images/free-robux-hack-generator-pc.pdfIn PDF document text
    • http://nikabio.com/images/free-robux-generator-without-human-verification-2021.pdfIn PDF document text
    • https://abouttimetech.com/images/flamingo-skin-but-its-free-roblox.pdfIn PDF document text
    • http://artindex.pro/images/ilum-hacks-roblox.pdfIn PDF document text
    • https://www.audipec.com.br/images/easy-robux-free-today.pdfIn PDF document text
    • http://www.metanoiaconsultantsglobal.com/images/how-to-get-1-robux-for-free.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/free-robux-alex.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/roblox-cheat-xbox-one.pdfIn PDF document text
    • http://baah.ca/images/cheat-tools-for-roblox.pdfIn PDF document text
    • http://www.learningbydoinglingue.com/images/atticus129-roblox-profile-hacked-account.pdfIn PDF document text
    +17 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008386.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8386 27328 bytes
SHA-256: 477638699f906188288456072f11821676713caa743eb543caff4d57e6474df9
font_01_sfnt_off0000c223.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC223 18224 bytes
SHA-256: 7bed574325654520ee21a60a089222f1966b1579fd1d724cc484952a79936c83