PDF malware analysis — malicious · 0393d82761425b40

MALICIOUS

PDF

61.5 KB Created: 2021-04-06 01:41:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-25

MD5: c995397ee3db3fb4aec7dd5f46a2b0e3 SHA-1: 49f18d874f00a1a774c39fe25dea4001829f38c0 SHA-256: 0393d82761425b401f682b07e981eb543308ff2a2d9e50426cb41490e628b688

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by an ML classifier. It uses a password-protected-archive lure. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.6193

Heuristics 4

Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/how-to-get-admin-commands-on-roblox-for-free PDF link annotation
- http://www.boic.nl/images/robux-gratis-funciona-hack-sin-cortes-2021.pdfIn PDF document text
- http://eastwestmacrobiotics.com/images/roblox-atil-t-hack.pdfIn PDF document text
- https://www.cosmosdawn.net/images/descargar-roblox-hackeado-para-android-2021.pdfIn PDF document text
- https://www.extremeoutdoorleague.co.za/images/free-robux-hack-generator-2021.pdfIn PDF document text
- http://www.adravietnam.org/images/download-hack-tool-for-roblox.pdfIn PDF document text
- http://www.compusiteinc.com/images/hacks-for-royal-high-roblox-2021.pdfIn PDF document text
- https://www.tsdb.com.au/images/hack-para-robux-en-roblox.pdfIn PDF document text
- http://ff-obertraun.at/images/how-to-get-free-robux-2021-january.pdfIn PDF document text
- http://ghegamethu.vn/images/cipherv3-roblox-exploit-rocky-hacks-and-more.pdfIn PDF document text
- https://cintasoeste.com.ar/images/serveru-hack-roblox.pdfIn PDF document text
- http://www.mikramarine.gr/images/free-roblox-jailbreak-account.pdfIn PDF document text
- http://www.brtes.com/images/how-to-get-free-money-in-jailbreak-roblox-2021.pdfIn PDF document text
- https://www.ferienhausdirektkroatien.de/images/tycoon-hack-roblox.pdfIn PDF document text
- http://ehma.com/images/ulgamesresources-com-free-robux-generator.pdfIn PDF document text
- https://www.ferienhausdirektkroatien.de/images/how-do-you-hack-in-jailbreak-roblox.pdfIn PDF document text
- http://escolaarboc.cat/images/how-to-get-free-robux-urban420-network.pdfIn PDF document text
- http://www.malonmalon.com.ar/images/hack-roblox-with-kali-linux.pdfIn PDF document text
- https://pagadder.com/images/anti-speed-hack-roblox-hack.pdfIn PDF document text
- https://gafaseo.com/images/roblox-katana-and-knife-hack.pdfIn PDF document text
- http://www.zdravazena.sk/images/hack-vehicle-simulator-roblox.pdfIn PDF document text
- https://www.stkdb.cz/images/100-working-free-robux.pdfIn PDF document text
- http://adues.org/images/game-save-gui-roblox-hack.pdfIn PDF document text
- http://addair.co.uk/images/kid-caught-cheating-on-his-roblox-gf.pdfIn PDF document text
- http://pgk-polaniec.pl/images/get-free-robux-without-sighning-in.pdfIn PDF document text
- http://www.adravietnam.org/images/free-roblox-studio-scripts.pdfIn PDF document text
- https://www.mrsz.ir/images/roblox-maniac-how-to-get-free-robux.pdfIn PDF document text
- http://sexythings.gr/images/roblox-hack-teleport.pdfIn PDF document text
- http://www.fvsspa.com/images/how-to-get-free-robux-2021-june.pdfIn PDF document text
- http://petarda.hu/images/hack-and-slash-point-and-click-games-roblox.pdfIn PDF document text
- http://lechia-sedziszow.pl/images/free-roblox-avatar-stuff.pdfIn PDF document text
- https://rincondelentrenador.com/images/free-uncopylocked-roblox-games-meganz.pdfIn PDF document text
- http://interpretation-dessins-enfants.net/images/roblox-hacks-bubble-gum.pdfIn PDF document text
- https://piscinasmundoacuatico.com/images/how-to-hack-roblox-jailbreak-2021.pdfIn PDF document text
- https://consorziocsa-asicaivano.it/images/installer-script-roblox-hack-gui.pdfIn PDF document text
- http://kids-academy.pl/images/package-roblox-free.pdfIn PDF document text
- http://ladagoterie.fr/images/cheat-engine-v3-roblox.pdfIn PDF document text
- http://www.ntc.edu.za/images/how-to-hack-in-any-roblox-account-2021.pdfIn PDF document text
- http://lichtdrukkerijwijchen.nl/images/como-hackear-robux-en-roblox.pdfIn PDF document text
- http://infoagronomia.com.ar/images/cheats-for-prison-life-roblox-2021.pdfIn PDF document text
- http://jaeger-bauplanung.de/images/roblox-free-without-sign-in-no-download.pdfIn PDF document text
- http://energotestcontrol.ru/images/roblox-games-for-free-no-download.pdfIn PDF document text
- https://bancroftandsons.com/images/codes-for-adopt-me-roblox-for-free-money-2021.pdfIn PDF document text
- https://www.coriglianocalabro.it/images/how-to-get-free-faces-on-roblox-october-2021.pdfIn PDF document text
- http://optsuvenir.by/images/how-to-get-free-robux-hack-no-download.pdfIn PDF document text
- https://www.polyfin.de/images/free-robux-generator-download-app.pdfIn PDF document text
- http://androidthai.in.th/images/free-respawn-rout-66-roblox.pdfIn PDF document text
- http://www.anies.eu/images/how-to-hack-on-roblox-prison-life.pdfIn PDF document text
- https://accord.kiev.ua/images/roblox-robux-hack-2021.pdfIn PDF document text
- https://socialvalue.gr/images/how-to-get-free-pants-on-roblox-2021.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000083f7.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x83F7	25544 bytes
SHA-256: `f3231344fbdd8b253e99633885774af2b540005439fa5c1a4c70566dcfe92888`
`font_01_sfnt_off0000bee9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBEE9	3952 bytes
SHA-256: `0c5ca538296474633365b6927c6fa7a9429e779bfe838fc4da078fd37f8be571`
`font_02_sfnt_off0000cbd7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCBD7	18584 bytes
SHA-256: `19fb5ce30287614e567b81df5dcd98c75710fe3fa72026fce9cab23a1b0ab8ce`

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Malware Insights

Machine Learning

Heuristics 4

Related samples 8

Extracted artifacts 3