PDF malware analysis — malicious · 0785dd57287da4cd

MALICIOUS

PDF

61.2 KB Created: 2021-04-05 19:44:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16

MD5: d0a398f434b1b0b76850dadd62a36bb1 SHA-1: 016f7a98fbf03e440222eab8be49e94c31ce1f08 SHA-256: 0785dd57287da4cd81008cf2cada9f7be8da1b8490f459d990b6453c8f7baa6d

142 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1218.011 System Binary Proxy Execution: Rundll32 T1037.004 Boot or Logon Initialization: Startup Folder T1553.005 Report False Positive

The document presents itself as a guide to hacking Roblox accounts, which is a common lure for social engineering attacks. It explicitly instructs the user to disable security software and use clipboard commands, indicating an attempt to bypass defenses and execute arbitrary commands. The embedded URLs likely lead to further stages of the attack, such as downloading and executing a malicious payload.

Machine Learning

Nyx PDF Classifier malicious score 0.6193

Heuristics 6

Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Security software disable instruction high SE_SECURITY_BYPASS

Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/how-to-hack-someone PDF link annotation
- http://ptts.pl/images/como-hackear-uma-conta-do-roblox.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/how-to-get-free-robux-from-the-robux-page.pdfIn PDF document text
- http://fairwaygolftravel.co.uk/images/free-robux-codes-working-2021.pdfIn PDF document text
- http://www.anies.eu/images/how-to-get-free-robux-without-doing-a-human-verification.pdfIn PDF document text
- http://www.adravietnam.org/images/roblox-john-doe-when-they-hack.pdfIn PDF document text
- https://socialvalue.gr/images/dragon-ball-rage-roblox-cheats.pdfIn PDF document text
- http://horsa18.ru/images/console-hack-roblox.pdfIn PDF document text
- http://safari-crimea.com/images/free-robux-generated.pdfIn PDF document text
- http://learningarabic.co.uk/images/roblox-pet-simulator-cheats.pdfIn PDF document text
- http://www.pcclawyers.com.au/images/roblox-bux-free.pdfIn PDF document text
- http://gops.pruszczgdanski.pl/images/cch-ly-robux-free-tren-dien-thoai.pdfIn PDF document text
- http://bau-lk.de/images/rc-roblox-hack.pdfIn PDF document text
- https://www.appartamenticroazia24.com/images/noclip-hack-roblox-jailbreak.pdfIn PDF document text
- https://www.milewood.co.uk/images/how-to-hack-roblox-experiment-lab.pdfIn PDF document text
- http://xn-----clcdhzcbmgnochhb1boe1a6b.xn--p1ai/images/roblox-hack-this-page.pdfIn PDF document text
- https://arcasict.nl/images/ho-to-get-free-glowing-skirt-on-royale-high-roblox.pdfIn PDF document text
- http://bned-leader.co.uk/images/robux-hacks-that-work-2021.pdfIn PDF document text
- https://wandersuechtig.de/images/roblox-wheel-of-fortune-hack.pdfIn PDF document text
- http://pourvosvacances.com/images/how-to-recover-your-hacked-roblox-account.pdfIn PDF document text
- https://meltonschool.org/images/free-auto-clicker-for-roblox-mobile.pdfIn PDF document text
- http://fotoflas.gr/images/how-do-you-download-roblox-for-free.pdfIn PDF document text
- http://agrupamentoescolas-alfredo-da-silva.com/images/can-cheat-engine-get-you-banned-roblox.pdfIn PDF document text
- https://www.sauvonsleclimat.org/images/roblox-booga-booga-cheat-duplicate-items.pdfIn PDF document text
- https://www.najeebqasmi.com/images/free-roblox-mouth-pack.pdfIn PDF document text
- http://m-sv.net/images/download-robux-online-hack.pdfIn PDF document text
- http://domaizdereva24.ru/images/unjailbreak-roblox-hack-download.pdfIn PDF document text
- http://s-punkt-objects.de/images/roblox-hacking-websites-free.pdfIn PDF document text
- http://energotestcontrol.ru/images/pagina-para-hack-en-roblox.pdfIn PDF document text
- https://www.hotschool.com.au/images/roblox-free-roblox-card-codes-2021.pdfIn PDF document text
- https://www.bmta.co.uk/images/cool-boy-hacker-roblox.pdfIn PDF document text
- http://www.rezbb.sk/images/retail-tycoon-roblox-hack.pdfIn PDF document text
- https://www.u-pin-it.com/images/roblox-lua-scripts-hacks.pdfIn PDF document text
- http://bilhetim.com.br/images/how-to-hack-other-peoples-accounts-on-roblox-2021.pdfIn PDF document text
- http://www.campiresine.it/images/roblox-hack-jailbreak-money.pdfIn PDF document text
- http://goosesscuba.com/images/roblox-cheat-noclip.pdfIn PDF document text
- http://schlossschaenke-andernach.de/images/roblox-666-hack-download.pdfIn PDF document text
- http://evp-sanorlenok.ru/images/hackear-prison-life-roblox-2021-pc-dansploit.pdfIn PDF document text
- https://reggieslockandkey.com/images/roblox-wizard-pants-free.pdfIn PDF document text
- https://pneukalousek.cz/images/conor3d-how-to-get-free-robux.pdfIn PDF document text
- http://imp.lg.ua/images/wwwbandicamcom-hack-roblox.pdfIn PDF document text
- http://babbibooth.com/images/how-to-make-pants-for-free-in-roblox.pdfIn PDF document text
- https://estalagemmonteverde.com.br/images/get-free-robux-just-by-joining-this-group.pdfIn PDF document text
- http://logisticgroup.co/images/how-to-get-robux-money-for-free.pdfIn PDF document text
- http://ff-obertraun.at/images/august-2021-free-robux-legit.pdfIn PDF document text
- http://gamixpaliwa.pl/images/how-to-hack-someone-on-roblox-2021.pdfIn PDF document text
- https://belixconstructions.com.au/images/glottis-how-to-get-free-robux-youtube.pdfIn PDF document text
- http://columbuscigar.com/images/roblox-bubble-gum-sim-free-pet.pdfIn PDF document text
- https://www.mrsz.ir/images/how-do-you-hack-roblox-adopt-me.pdfIn PDF document text
- http://wireprod.net/images/roblox-phantom-forces-flame-cheat.pdfIn PDF document text
+21 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00008395.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8395	27412 bytes
SHA-256: `03b4974563bbca7aaaabf7d6a716f4f902cad9259e856bb793770b1eaffed126`
`font_01_sfnt_off0000c079.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC079	2848 bytes
SHA-256: `4737c2778a085e0cb49e73f3b054b1a71e3f40720d213b4bfda97f95a31bfbf1`
`font_02_sfnt_off0000ca3a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA3A	18804 bytes
SHA-256: `f3a25bfb5cfddbb7d77414f4e37f8c85fa873f6cd5e25d8c638b168a27b928b5`

Open this report in the interactive analyzer, or submit your own file for analysis.