Malicious PDF — malware analysis report

Static analysis result for SHA-256 08a8e41a8233484e…

MALICIOUS

PDF

60.5 KB Created: 2021-04-06 01:53:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-31
MD5: d4acba3ab094bc2f2917fe78e0a59255 SHA-1: ce5bd7450ad63fd12e605765d58f711cdb879695 SHA-256: 08a8e41a8233484e26ccb367346dcd323beb3592360e5ac21460b8c6a5180701
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of links and references to "free Roblox accounts", "hacks", and "robux", indicating a scam or phishing attempt. The heuristic PDF_GAME_HACK_SEO_LINK_FARM specifically identifies this as a link farm designed to lure users with game-related scams. While no scripts were explicitly extracted, the nature of the content and the numerous external URLs suggest a malicious workflow aimed at redirecting users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-roblox-accouts-that-work PDF link annotation
    • http://thehancgroup.com/images/free-imits-in-catolg-in-roblox.pdfIn PDF document text
    • http://autenticohostalsalou.com/images/free-school-campus-roblox.pdfIn PDF document text
    • http://cleanteclogistics.com/images/roblox-apk-hack-2021.pdfIn PDF document text
    • https://www.cnte.org.br/images/boga-boga-roblox-hack.pdfIn PDF document text
    • http://jobsy.com.sg/images/roblox-name-change-free.pdfIn PDF document text
    • https://bdsm-centrum.com/images/hack-roblox-how-to-be-dark-veder-in-wild-west.pdfIn PDF document text
    • http://dennemaat.nl/images/boku-no-roblox-remastered-money-hack.pdfIn PDF document text
    • https://millatgears.com/images/roblox-script-greenwood-town-free-vampire.pdfIn PDF document text
    • http://sdservicesrl.it/images/roblox-hack-injector-dll.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/granny-roblox-free-download.pdfIn PDF document text
    • http://www.vktzunami.cz/images/hack-to-find-people-ingame-in-roblox-cheat.pdfIn PDF document text
    • http://www.torvet11.dk/images/roblox-hackclub-2021.pdfIn PDF document text
    • https://belixconstructions.com.au/images/pink-paradigm-hack-created-by-lord-of-robux-explication.pdfIn PDF document text
    • http://legs11.co.za/images/how-to-hack-unblock-roblox-password.pdfIn PDF document text
    • http://mostowicz.pl/images/lavar-hack-com-roblox.pdfIn PDF document text
    • http://gaeconsultores.cl/images/how-to-have-free-clothes-on-roblox.pdfIn PDF document text
    • https://www.brainpads.com/images/utiliser-des-cheat-roblox.pdfIn PDF document text
    • http://nosocomium.rv.ua/images/roblox-speed-hack-check-cashed.pdfIn PDF document text
    • https://www.tsdb.com.au/images/como-tener-free-robux-on-roblox.pdfIn PDF document text
    • http://enjoybabelisland.com/images/free-roblox-gift-crafts.pdfIn PDF document text
    • https://www.utalii.ac.ke/images/basketball-free-charactes-in-roblox.pdfIn PDF document text
    • http://fred.com.ua/images/roblox-free-robux-no-real-money.pdfIn PDF document text
    • http://elllanorestaurants.com/images/roblox-retail-tycoon-hack-save-game.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/april-fools-roblox-hacking-date.pdfIn PDF document text
    • http://racunari.in.rs/images/roblox-cbro-aimbot-hack.pdfIn PDF document text
    • https://itv-grabungen.de/images/free-100-robux-card-codes-2021.pdfIn PDF document text
    • https://photographygroupofbunbury.com/images/how-to-get-free-vip-in-roblox-fe2.pdfIn PDF document text
    • http://apcupschennai.com/images/how-to-hack-someone-in-roblox-using-captra.pdfIn PDF document text
    • http://selectionspdf.fr/images/roblox-players-for-free.pdfIn PDF document text
    • https://www.lomrad.go.th/images/counter-blox-roblox-offensive-hack-download-free.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/how-to-make-ur-noclip-hack-undetectible-in-roblox.pdfIn PDF document text
    • http://villazeus.eu/images/roblox-free-robux-obby.pdfIn PDF document text
    • http://kids-academy.pl/images/free-blue-hair-in-roblox.pdfIn PDF document text
    • http://fratellimazzoleni.it/images/how-to-noclip-hack-in-roblox-2021.pdfIn PDF document text
    • https://newenglandafs.com/images/get-free-robux-no-download-no-verification.pdfIn PDF document text
    • https://www.cfdcnv.com/images/hacks-para-juegos-de-roblox-2021.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/free-supreme-shirts-roblox.pdfIn PDF document text
    • http://domaizdereva24.ru/images/free-games-twitter-roblox.pdfIn PDF document text
    • http://ericvanpraet.eu/images/free-bc-roblox-accounts-2021.pdfIn PDF document text
    • http://southernhills-golf.com/images/free-robux-website-no-human-verification.pdfIn PDF document text
    • http://canadatowers.com/images/como-hackear-roblox-apk-mediafire-para-ir-mas-rapido.pdfIn PDF document text
    • https://www.eglihotel.gr/images/how-to-hack-robux-with-cheat-engine-65.pdfIn PDF document text
    • http://egorplitka.ru/images/lego-hacking-roblox-download.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/how-to-make-a-free-shirt-in-roblox-no-bc.pdfIn PDF document text
    • http://www.les2alpes-location.com/images/how-to-put-cheat-codes-roblox-bubble-gum.pdfIn PDF document text
    • http://intrasservices.com/images/free-roblox-promo-codes-november-2021.pdfIn PDF document text
    • http://genialica.com/images/roblox-cheats-for-robux-for-phone.pdfIn PDF document text
    • http://legs11.co.za/images/claim-free-robux-game-roblox.pdfIn PDF document text
    • http://www.actae.gr/images/free-robux-does-not-work.pdfIn PDF document text
    +17 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000081cb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x81CB 26728 bytes
SHA-256: 576225ff4a80579a66c5625473b3448309838a8b06b75021c9f06ba2abe1215d
font_01_sfnt_off0000be7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE7B 2832 bytes
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2
font_02_sfnt_off0000c82b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC82B 18520 bytes
SHA-256: b43b65f2fe3f296107e7892d8f4d1cd0ddeef87b6affdafa195b982bd5705336