PDF static analysis report

Static analysis result for SHA-256 f0970e9c325f2564…

SUSPICIOUS

PDF

38.8 KB Created: 2021-04-30 05:41:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 85c06d19c1b4a839abc5d1237bb26c01 SHA-1: 54588cf62a2bab1e2745d29eba0f64c9782adac0 SHA-256: f0970e9c325f25648dfa9f30b319404a3aab89c92022bb878abb5b57aae15e33
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs, with one prominently featured in the document body and heuristics, suggesting it's the primary lure. The ML classifier strongly flagged this PDF as malicious. The document body text and embedded URLs indicate a lure related to "Hacks Roblox Phantom Forces" and a "generator", likely aiming to trick users into downloading malware. No scripts were extracted, but the presence of embedded URLs and the ML classification point towards a malicious intent to deliver a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9408

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/hacks-roblox-phantom-forces-game-hack PDF link annotation
    • https://fridaytravelnepal.com/userfiles/files/free-model-purchase-request-roblox.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/redeem-code-roblox-free-robux-2021.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-promocodes-hack.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/fps-roblox-hacks.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/getbucks-free-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000039b2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x39B2 25424 bytes
SHA-256: b1e84bad7b0ee5bdaf396c2dd7961984fabd18e799652d7b2798ce8eb743cd01
font_01_sfnt_off0000743c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x743C 19028 bytes
SHA-256: e06b6b45d02efe17d360f1057195ddf03791c1d2fcd873b53f1ae9a99d5d7e87

Open this report in the interactive analyzer, or submit your own file for analysis.