Malicious PDF — malware analysis report

Static analysis result for SHA-256 0641d6876dc8ea3e…

MALICIOUS

PDF

40.1 KB Created: 2021-04-03 12:32:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 0dfa17f16e6e91cc3292fd55e2db81bf SHA-1: bfea065314d45289e75199002997de1b6646cd0e SHA-256: 0641d6876dc8ea3e25afc53ef43ec6a7e08941f5cd5057f01df89fff02e28457
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites that promise free in-game currency or hacks for the game Roblox. The heuristic firings indicate this is a link farm designed to lure users to potentially malicious sites. While no scripts were extracted, the document body and heuristics strongly suggest a phishing or scam attempt leveraging game-related lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-roblox-water-bottle-labels PDF link annotation
    • http://sscclc.edu.ec/images/roblox-free-without-sign-in-no-download.pdfIn PDF document text
    • http://www.jureclomas.com.ar/images/robux-hack-my-dudes.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/how-to-get-a-free-skin-in-strucid-roblox.pdfIn PDF document text
    • http://www.vktzunami.cz/images/how-to-hack-roblox-jailbreak-beginner.pdfIn PDF document text
    • http://dos.most.gov.la/images/roblox-games-with-free-robux.pdfIn PDF document text
    • https://www.abrapppe.org.br/images/how-to-get-free-tickets-in-roblox.pdfIn PDF document text
    • http://www.maakherumusic.net/images/speed-city-hacks-roblox.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/how-to-get-free-robux-hack-no-verification.pdfIn PDF document text
    • https://www.albisser.ch/images/free-robux-using-inspect-2021.pdfIn PDF document text
    • https://technospektr.com.ua/images/hackear-robux-gratis.pdfIn PDF document text
    • http://nosocomium.rv.ua/images/thebuxian-you-have-robux-try-hack-today.pdfIn PDF document text
    • https://www.lavigny.ch/images/strawberry-roblox-hack.pdfIn PDF document text
    • http://uptodate.az/images/c-design-roblox-hack.pdfIn PDF document text
    • http://www.copoint.co.uk/images/roblox-slaying-simulator-cheats.pdfIn PDF document text
    • https://kimolos-link.gr/images/hack-roblox-vip.pdfIn PDF document text
    • https://www.cnte.org.br/images/free-robux-generator-pro.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/robux-hack-apk-2021.pdfIn PDF document text
    • http://www.vktzunami.cz/images/roblox-lua-script-hacks-gui.pdfIn PDF document text
    • https://pa-waingapu.go.id/images/free-robux-roblox-online-generator.pdfIn PDF document text
    • http://www.cuniv-naama.dz/images/how-to-get-any-roblox-gamepass-for-free-2021.pdfIn PDF document text
    • http://www.torvet11.dk/images/things-that-are-free-on-roblox.pdfIn PDF document text
    • http://kids-academy.pl/images/cheat-phantom-forces-roblox.pdfIn PDF document text
    • http://uptodate.az/images/hack-roblox-android-lucky-patcher-2021.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/free-rs-in-roblox.pdfIn PDF document text
    • https://www.lomrad.go.th/images/roblox-dashing-simulator-hacks.pdfIn PDF document text
    • https://jdlgroup.ca/images/how-to-hack-breaking-point-roblox.pdfIn PDF document text
    • http://sscclc.edu.ec/images/how-do-you-get-free-robux-2021.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/hack-robux-2021.pdfIn PDF document text
    • https://verdensbarn.no/images/how-to-change-your-name-for-free-roblox.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/roblox-how-to-upload-custom-thumbnails-for-free.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off000043f0.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000043f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x43F0 25228 bytes
SHA-256: 00fb3edba1bae6bbc7e1982e48d9abc441dc0687738a2a2c5cbb2d877c4294e7
font_01_sfnt_off00007a49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A49 17904 bytes
SHA-256: ae08ae0572799ecc2ec378955a059feb080cdfc6c372e2c95da1d167e7211181

Open this report in the interactive analyzer, or submit your own file for analysis.