PDF static analysis report

Static analysis result for SHA-256 f3b261a231c41af5…

SUSPICIOUS

PDF

32.5 KB Created: 2021-04-03 21:54:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-25
MD5: ee8926a25e6f4b7bf14bca9933e0f2c4 SHA-1: 328da455a0b13a46f85b14f6a39fd9ad0d8ea10a SHA-256: f3b261a231c41af5f425e69fadfa4aff9ad4713f572a9359f9364e03dafefe47
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as suspicious by an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9725

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/best-sites-to-get-free-robux PDF link annotation
    • http://kids-academy.pl/images/artificial-intelligence-roblox-hack.pdf%0AIn PDF document text
    • https://consorziocsa-asicaivano.it/images/free-item-roblox-pastebin.pdf%0AIn PDF document text
    • https://www.air-shop.cz/images/free-robux-generator-no-survey-no-human-verification-2021.pdf%0AIn PDF document text
    • https://wandersuechtig.de/images/free-gift-card-codes-for-robux.pdf%0AIn PDF document text
    • http://portal.crfsp.org.br/images/account-roblox-hack.pdf%0AIn PDF document text
    • http://nosocomium.rv.ua/images/robux-generator-no-survey-no-hack.pdf%0AIn PDF document text
    • https://jdlgroup.ca/images/how-to-hack-breaking-point-roblox.pdf%0AIn PDF document text
    • http://www.eurosan1.ba/images/how-to-hack-roblox-with-cheat-engine-67.pdf%0AIn PDF document text
    • https://jdlgroup.ca/images/spinning-hack-roblox.pdf%0AIn PDF document text
    • http://www.lionel-seppoloni.fr/images/roblox-how-to-get-free-animation-packs.pdf%0AIn PDF document text
    • https://www.osoc.com/images/get-free-robux-on-roblox-cheat.pdf%0AIn PDF document text
    • https://sitam.co.in/images/roblox-team-changer-hack.pdf%0AIn PDF document text
    • https://www.najeebqasmi.com/images/free-robux-2021-for-pc.pdf%0AIn PDF document text
    • http://www.actae.gr/images/how-to-actually-get-free-robux-2021.pdf%0AIn PDF document text
    • https://esl.ipb.ac.id/images/how-to-get-free-robux-on-windows-10-2021.pdf%0AIn PDF document text
    • https://www.sinaloadiario.mx/images/how-to-hack-roblox-wild-savannah-inf-health-hack.pdf%0AIn PDF document text
    • https://www.millatgears.com/images/robux-inspect-hack-2021.pdf%0AIn PDF document text
    • http://ns1.radiofacil.net/images/comment-cheat-sur-roblox-retail-tycoon-1211.pdf%0AIn PDF document text
    • http://www.agri-tech.com.au/images/injector-de-hacks-para-roblox.pdf%0AIn PDF document text
    • https://estalagemmonteverde.com.br/images/how-to-get-free-robux-in-roblox-december-2021.pdf%0AIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/how-do-you-get-free-robux-without-doing-anything.pdf%0AIn PDF document text
    • https://verdensbarn.no/images/how-to-hack-anyones-account-on-roblox-still-working-2021.pdf%0AIn PDF document text
    • http://www.awakeningtruth.org/images/free-robux-without-a-human-verification.pdf%0AIn PDF document text
    • https://www.coriglianocalabro.it/images/free-roblox-on-chrome.pdf%0AIn PDF document text
    • https://www.albisser.ch/images/free-roblox-money-codes-2021.pdf%0AIn PDF document text
    • http://www.ntc.edu.za/images/get-free-robux-codes-email.pdf%0AIn PDF document text
    • http://zarinnameh.ir/images/free-things-in-catalog-roblox.pdf%0AIn PDF document text
    • http://www.rezbb.sk/images/how-to-get-free-robux-2021-march.pdf%0AIn PDF document text
    • http://www.rezbb.sk/images/hack-robux-with-cheat-engine-64.pdf%0AIn PDF document text
    • https://www.foodsafety.cz/images/roblox-surf-hack-script-2021.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000343b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x343B 19368 bytes
SHA-256: 48ab0e04747cdf5553b2ab88b47e8dcbe2b36861fe65ab7e5266327376659ca3
font_01_sfnt_off00005d3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D3E 17660 bytes
SHA-256: e75e534e123b52bb58c13fcd76f614ddd9014e913db142c49df871a65a25509f

Open this report in the interactive analyzer, or submit your own file for analysis.