PDF static analysis report

Static analysis result for SHA-256 edca0919c7e0a031…

SUSPICIOUS

PDF

42.4 KB Created: 2021-04-27 23:58:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: baf448b43a9050d6d9708cd115ede297 SHA-1: 71cbaa03ca58ab93c0098ad75012e13503c06cd7 SHA-256: edca0919c7e0a031910eb738052b8d43ef025a49cb5cc76e42557a8d690a838c
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a visible 'CLICK HERE TO ACCESS ROBLOX GENERATOR' call-to-action, strongly suggesting a lure for users to download potentially malicious software. The ML classifier also flagged this PDF with high confidence. The primary IOC is the external URL that likely hosts the payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/god-mode-dll-hack-roblox-game-hack PDF link annotation
    • http://www.saburai.ac.id/elibrary//repository/roblox-those-who-remain-hack-script.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/again-here-for-free-robux-on-roblox-com-free4mobile24-com.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/robux-store-free.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/free-robux-not-a-scam-ehclips.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/hack-tool-for-roblox-pc.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/roblox-cheat-engine-wall-hack.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-hack-roblox-with-command-prompt.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/como-hackear-cuentas-de-roblox.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/hack-accounts-roblox-2021.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/roblox-hack-pc-2021.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004368.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4368 27920 bytes
SHA-256: c6f8be7c6313563a874a38913b3ae22fbe615726de12656f772939089d459ac5
font_01_sfnt_off000082dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82DC 18720 bytes
SHA-256: b9b7368fb201d3c03cbd40dcc724ef20685b86ee7ab6b4b5ebafedb0064afd71

Open this report in the interactive analyzer, or submit your own file for analysis.