Malicious PDF — malware analysis report

Static analysis result for SHA-256 05922479fddc9605…

MALICIOUS

PDF

249.5 KB Created: 2021-04-05 16:05:18 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-18
MD5: d000cd6fc72cc588f5b9c4edd4737c54 SHA-1: 7e3bc86d9885544624d0bd83e82a76563f705b33 SHA-256: 05922479fddc9605d6cdd0cd6eff074765022710147e246976f71e39f2f0eeac
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Pdf.Phishing.Roblox062100-9873116-0. It contains multiple embedded URLs, with the primary one being http://gaminggenerator.org/app/431946152/cheat-roblox-jailbreak-speed-hack, suggesting a phishing or malware distribution lure related to game cheats. The presence of a 'download button' heuristic further supports this malicious intent.

Machine Learning

  • Nyx PDF Classifier clean score 0.2292

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/cheat-roblox-jailbreak-speed-hack PDF link annotation
    • http://dcmetroapp.com/images/funny-roblox-outfits-and-free-outfits.pdfIn PDF document text
    • http://axiapublishers.com/images/counter-blox-roblox-offensive-hacks-wall-hacks.pdfIn PDF document text
    • http://acktivities.com/images/roblox-games-free-roblox-games.pdfIn PDF document text
    • http://parsbaft.com/images/roblox-jailbreak-hack-free.pdfIn PDF document text
    • http://www.hotelcimone.it/images/roblox-tycoon-free.pdfIn PDF document text
    • http://edelektronarzedzia.pl/images/roblox-avatar-maker-free.pdfIn PDF document text
    • http://only1you.ru/images/good-uniform-making-software-free-roblox.pdfIn PDF document text
    • http://jackson-pr.com/images/free-robux-no-games-to-download.pdfIn PDF document text
    • http://junktiquecollector.com/images/free-robux-on-roblox-app.pdfIn PDF document text
    • https://dirigentigiustizia.it/images/how-to-hack-roblox-with-inspect-element-2021.pdfIn PDF document text
    • http://ce-tsv-nantes.fr/images/test-drive-evolution-roblox-hack.pdfIn PDF document text
    • http://firstaidacademy.be/images/free-robux-without-survey-or-download.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/roblox-site-free-robux.pdfIn PDF document text
    • http://webstan.be/images/roblox-free-robux-promo-codes-2021.pdfIn PDF document text
    • http://tecnodue.com/images/free-robux-si.pdfIn PDF document text
    • http://imp.lg.ua/images/free-roblox-t-shirts-that-are-cool.pdfIn PDF document text
    • http://smoothjazzclub.net/images/free-roblox-exploit-scripts-for-executor.pdfIn PDF document text
    • http://bowling-am-froschpark.de/images/vechle-simulator-roblox-hack.pdfIn PDF document text
    • http://arkivthy.dk/images/lvl-7-roblox-hacks.pdfIn PDF document text
    • http://meisterhaus-guterl.de/images/roblox-hack-v414.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/rbxcommunity-com-free-robux.pdfIn PDF document text
    • http://greenoase.be/images/pagina-free-robux.pdfIn PDF document text
    • https://socialvalue.gr/images/free-roblox-gift-card-redeem-codes.pdfIn PDF document text
    • https://eurekaaccounting.co.za/images/roblox-hack-tap.pdfIn PDF document text
    • http://grand-ural74.ru/images/bunny-ears-2021-free-roblox.pdfIn PDF document text
    • https://ogm-goettingen.de/images/how-to-get-free-robux-on-roblox-fast-and-easy.pdfIn PDF document text
    • http://restarmenia.com/images/free-robux-no-survey-2021-ios.pdfIn PDF document text
    • http://legs11.co.za/images/roblox-cheat-island-tribes.pdfIn PDF document text
    • http://fratellimazzoleni.it/images/how-to-hack-roblox-games-no-downloads-2021.pdfIn PDF document text
    • https://liftkos.com/images/roblox-hack-descargar-para-pc-robux.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00038343.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38343 25900 bytes
SHA-256: 2b09fb950338e0f2748ecd787cccff5948f72712aa6f88810f468a609dbee0a5
font_01_sfnt_off0003be4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BE4D 18460 bytes
SHA-256: a6415f63a099eb6592102ef463b1376b8ea3d5837305bb8f16cb2093f4194aa1