Malicious PDF — malware analysis report

Static analysis result for SHA-256 08971e4cf97aeaa4…

MALICIOUS

PDF

53.1 KB Created: 2021-04-06 14:15:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 7486d103e0f3696a2a89c383adf6e3f0 SHA-1: 599393171e5a91b47c9b9563ce3395d3690c4c85 SHA-256: 08971e4cf97aeaa417c720d6e27fed0a0e82588104f4162f0bba5c105629375b
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple heuristics indicating a lure for a game hack, specifically targeting Roblox. The document body and embedded URLs point to external sites offering 'free injectors' or 'hacks', which are likely malicious. The primary URL, https://enigmagenerator.com/app/431946152/roblox-game-hack, is presented as a call-to-action, suggesting the document's purpose is to redirect users to a potentially harmful download or exploit site. No scripts were extracted, but the PDF structure and embedded URLs strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8721

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://mypizzaoven.com/images/exploit-roblox-hack-download.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/hack-r-roblox.pdfIn PDF document text
    • http://precisionheavyhaul.com/images/roblox-items-that-are-no-longer-free.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/case-clicker-coin-flip-hack-roblox.pdfIn PDF document text
    • http://gestibrok.com/images/best-free-roblox-screen-recorder.pdfIn PDF document text
    • http://www.drent.se/images/hack-de-monedas-de-roblox.pdfIn PDF document text
    • http://hemmet-strand.dk/images/ccv3-hack-roblox.pdfIn PDF document text
    • http://pia2000.net/images/roblox-cheat-engine-64-codes.pdfIn PDF document text
    • http://santeh-40.ru/images/descargar-hacks-para-roblox-gratis.pdfIn PDF document text
    • http://mostowicz.pl/images/roblox-deathrun-cheats.pdfIn PDF document text
    • https://dirigentigiustizia.it/images/roblox-dex-explorer-hack-script.pdfIn PDF document text
    • https://uofk.edu/images/how-to-hack-roblox-for-robux-on-ipad.pdfIn PDF document text
    • http://smoothjazzclub.net/images/how-to-change-your-skin-in-roblox-for-free.pdfIn PDF document text
    • http://www.tamogatoweb.hu/images/how-to-speed-hack-on-roblox-sword-fighting-tournament-39.pdfIn PDF document text
    • https://bancroftandsons.com/images/free-robux-pc-no-survey-no-verification.pdfIn PDF document text
    • https://tokunfome.com.br/images/roblox-hack-robux-and-tix-no-download-no-survey.pdfIn PDF document text
    • https://gzog.pl/images/roblox-admin-hack-mac.pdfIn PDF document text
    • http://julo-it.net/images/robux-generator-2021-free.pdfIn PDF document text
    • http://innovativefs.co.uk/images/youtubecom-ultraw-free-robux.pdfIn PDF document text
    • https://bapalaye.org/images/how-to-get-free-knife-in-assassin-roblox.pdfIn PDF document text
    • http://poltekkeskhjogja.ac.id/images/roblox-font-download-free.pdfIn PDF document text
    • http://the-specials.ch/images/easy-robux-com-free-robux.pdfIn PDF document text
    • https://www.ferienhausdirektkroatien.de/images/free-credit-card-to-buy-robux.pdfIn PDF document text
    • http://chocolats-boccardi-carcassonne.com/images/how-to-hack-in-roblox-murderer-mystery-2.pdfIn PDF document text
    • https://pa-waingapu.go.id/images/build-to-survive-zombie-free-roblox.pdfIn PDF document text
    • http://fradiomas.com/images/how-do-u-get-free-obc-including-robux.pdfIn PDF document text
    • http://dottgagliardi.com/images/follower-generator-free-roblox.pdfIn PDF document text
    • http://abqwinair.com/images/how-to-get-robux-on-roblox-for-free-ipad.pdfIn PDF document text
    • http://keycitykennelclub.org/images/roblox-ninja-legends-hacks-download.pdfIn PDF document text
    • https://hbpbenin.com/images/how-to-hack-super-jump-on-roblox.pdfIn PDF document text
    • https://reggieslockandkey.com/images/hack-prison-life-roblox-2021.pdfIn PDF document text
    • http://sandra-masemann.de/images/how-to-hack-roblox-for-robux-on-computer.pdfIn PDF document text
    • http://drentklubben.se/images/free-robux-new-logo.pdfIn PDF document text
    • http://fradiomas.com/images/free-robux-codes-2021-october.pdfIn PDF document text
    • http://stroybelan.ru/images/free-roblox-hacks-net.pdfIn PDF document text
    • http://eurocomes.com/images/how-to-get-free-robux-using-promo-codes.pdfIn PDF document text
    • http://galletta.com/images/ulgamesresources-com-free-robux-generator.pdfIn PDF document text
    • http://safwafurniture.com/images/roblox-murder-mystery-2-candies-hack.pdfIn PDF document text
    • http://cmme.it/images/como-hackear-roblox-para-tener-robux-gratis-2021.pdfIn PDF document text
    • http://galletta.com/images/free-robux-works-no-surveys-no-human-verification-2021.pdfIn PDF document text
    • https://www.audev.com/images/roblox-the-legendary-swords-rpg-hack.pdfIn PDF document text
    • https://ambarevleri.com/images/adopt-me-roblox-money-hack-2021.pdfIn PDF document text
    • http://ottawavalleykitchens.ca/images/change-roblox-username-free.pdfIn PDF document text
    • http://prohsa.com/images/roblox-buy-robux-free.pdfIn PDF document text
    • https://www.ncscolour.no/images/no-human-verification-free-robux-2021-working.pdfIn PDF document text
    • http://ruksnaitis.com/images/roblox-fling-hack.pdfIn PDF document text
    • http://kundentest.de/images/roblox-how-to-get-free-admin-in-any-game.pdfIn PDF document text
    • http://egorplitka.ru/images/roblox-robux-hack-no-survey-no-password.pdfIn PDF document text
    • http://bilhetim.com.br/images/roblox-vampire-hunters-2-cheats.pdfIn PDF document text
    +10 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000070f7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x70F7 26540 bytes
SHA-256: 594d85c79cdeeb76c63cd18f2bc036283333f18a8307ee76ad5c3e2e327943d1
font_01_sfnt_off0000acd7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACD7 17964 bytes
SHA-256: d2491e4cf3c174859a9f6a23b3329aba83747d1d478a7cdde69d6f4fd433c015

Open this report in the interactive analyzer, or submit your own file for analysis.