PDF static analysis report

Static analysis result for SHA-256 ecf5edf0e48f42fe…

SUSPICIOUS

PDF

44.7 KB Created: 2021-04-25 07:49:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: a0368fc3c5e92ad08531e3b2b96bf7c8 SHA-1: 74734a13644d32a8594e91a546e319dcdcdef77f SHA-256: ecf5edf0e48f42fefcf344facd168ac43aa14513faa92502470097ec548f8053
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains multiple embedded URLs and a heuristic firing for PDF_URI, indicating an attempt to redirect users to external content. The document body, though heavily obfuscated, contains references to game-related downloads and hacks, suggesting a lure for potentially malicious downloads. The ML classifier also flagged this PDF as malicious with a high score.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9863

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-offline-free-download-pc-game-hack PDF link annotation
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-free-roblox-accounts.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-doungnquest-legandary-hack.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-hack-points-on-roblox.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/nexus-hacking-roblox.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/hack-accounts-roblox-script.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/javascript-robux-hack-pastebin.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-use-cheat-engine-on-roblox-2021.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-free-play-no-app.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/csgo-hack-script-roblox-2021.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-get-any-amernation-free-in-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000043cc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x43CC 26312 bytes
SHA-256: e87e1a5b857d1e166645b84cbe9d42f3644e905616ee58aa71464e0674c04e24
font_01_sfnt_off000080b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80B1 2896 bytes
SHA-256: 90d77d065f93150ee652ed3ce79924b5ebfcae47abf79a24366adbef9fa21c4a
font_02_sfnt_off00008ab0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8AB0 18956 bytes
SHA-256: f72af52ec74af1ebd48938093eefb688540cfe604b11a13b17ac40fcab7fc583

Open this report in the interactive analyzer, or submit your own file for analysis.