PDF static analysis report

Static analysis result for SHA-256 f243b448deb40dde…

SUSPICIOUS

PDF

41.5 KB Created: 2021-04-30 05:04:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 2b5ab66f46b73b68841c3b35a514e2b6 SHA-1: 85db22edb03043ded6b9008b4a5404a775861a6a SHA-256: f243b448deb40dde59610b86d0116a987063b01dc6f0be63ca0c1ab8783cb582
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a lure related to 'Cheat Engine' for Roblox, directing users to an external URL for download. The ML classifier strongly flagged this PDF as malicious. While no scripts were extracted, the presence of multiple suspicious URLs and the document's theme suggest an attempt to trick users into downloading malware or unwanted software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/cheat-engine-roblox-2021-august-game-hack PDF link annotation
    • https://guiasderonda.es/ckfinder/userfiles/files/free-robux-codes-no-survey-2021-october.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/ezekiel-free-robux.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/roblox-money-cheats-for-rocitizens.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/how-to-get-free-robux-with-bc.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/roblox-hide-and-seek-extreme-hack.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/discord-roblox-hack-server.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/what-do-you-do-if-you-get-hacked-on-roblox.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/roblox-best-hack-for-jailbreak.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/free-roblox-battle-royale.pdfIn PDF document text
    • https://guiasderonda.es/ckfinder/userfiles/files/free-robux-without-installing-anything.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000432d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x432D 25704 bytes
SHA-256: b9e17bf9dfdfb12c7741286f12d5545df47a234cb6dfbd11599571bed72d344d
font_01_sfnt_off00007d97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D97 19232 bytes
SHA-256: 38500bce5364ee9ca5879dff61bc2e3b4f790c29eb0270dc6d13580b3a1f052d

Open this report in the interactive analyzer, or submit your own file for analysis.