PDF static analysis report

Static analysis result for SHA-256 fb05a08a5d3b9a41…

SUSPICIOUS

PDF

34.7 KB Created: 2021-07-05 10:21:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: c9ef6862381290f98e0d0b0ec135ee93 SHA-1: db5c33c9e8a488a22342e40a70df264b7920c668 SHA-256: fb05a08a5d3b9a4172f49c9aaa25ff60d064b6aa7bb61b8ff57db516ec2e8748
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a prominent external URI pointing to sites offering game hacks and free items, strongly suggesting a lure for users to download potentially malicious files. The ML classifier also flagged this PDF with high confidence. While no scripts were explicitly extracted, the presence of multiple download-oriented links indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-roblox-clothes-templates-game-hack PDF link annotation
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/roblox-prison-royale-hack_GM431946152.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/free-minecraft-bedrock-server-hosting_GM479516143.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/apocylopse-rising-roblox-hacks_GM431946152.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/builders-club-roblox-free-download_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/how-to-get-free-clothes-on-roblox-without-bc-2021_GM431946152.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/free-barbie-roblox-games_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/coin-master-email-free-spins_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/script-executor-roblox-free_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-on-roblox-on-ipod_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/hacker-face-roblox_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/how-to-get-free-pet-food-on-coin-master_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/how-to-hack-robux-on-phone_GM431946152.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/final-stand-hack-roblox_GM431946152.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/free-robux-acces-code_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/is-minecraft-bedrock-edition-free_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/coin-master-hack-mod-apk_GM406889139.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/coin-master-free-spins-and-coins_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/free-robux-today_GM431946152.pdfIn PDF document text
    • http://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/free-minecraft-alt-generator_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsn7kediri.sch.id/__statics/gudangsoal/files/how-to-get-free-cards-on-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003011.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3011 22404 bytes
SHA-256: 115c78f1daa6a4bb25180dfc78f3e7b00b38e88ad712288e142248d97e1af644
font_01_sfnt_off000061e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61E7 19356 bytes
SHA-256: ed8afa3911abce236b162dddd308dc518612872d30365d77fdf77b284c1332f6

Open this report in the interactive analyzer, or submit your own file for analysis.