PDF malware analysis — malicious · 09cee639365364d7

MALICIOUS

PDF

246.2 KB Created: 2021-04-05 06:41:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24

MD5: 1969af0109c70887f928ce01dbfd2211 SHA-1: fd403ad259fc90b02bc086ee13d43f3d890d9c31 SHA-256: 09cee639365364d73e9563c31b27a8d73f0f60f8f3e28a2a734e7a4105364976

72 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document detected by ClamAV as 'Pdf.Phishing.Roblox062100-9873116-0'. It contains multiple URLs related to Roblox hacks and free items, suggesting a phishing or scam attempt. The presence of embedded URLs and a download button lure indicates an attempt to trick the user into downloading further malicious content.

Machine Learning

Nyx PDF Classifier suspicious score 0.2693

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/how-to-edit-script-for-roblox-hack PDF link annotation
- http://alpen-seeblick.at/images/how-to-hack-admin-roblox-dll.pdfIn PDF document text
- https://schaefer-rechtsanwaelte.com/images/roblox-hack-tool-no-survey.pdfIn PDF document text
- https://gestionpatrimonial.net/images/roblox-game-studio-unblocked-cheats-download-guide-unofficial.pdfIn PDF document text
- http://tehergumi.hu/images/simple-ways-to-get-free-robux.pdfIn PDF document text
- http://steklofara.com.ua/images/roblox-glitch-to-get-free-robux.pdfIn PDF document text
- http://goosesscuba.com/images/free-roblox-clothes-and-hair-not-model.pdfIn PDF document text
- http://bunadsmaria.com/images/how-to-use-chatbot-hack-roblox.pdfIn PDF document text
- http://fiur-malermeister.de/images/roblox-2021-free-items.pdfIn PDF document text
- http://rafaelmontesinos.com/images/how-to-get-free-roblox-without-downloading-anything.pdfIn PDF document text
- http://technologicalsc.com/images/redeem-roblox-virtual-item-free.pdfIn PDF document text
- http://bned-leader.co.uk/images/free-robux-hack-no-human-verification-2021.pdfIn PDF document text
- https://www.cosmosdawn.net/images/roblox-hack-with-cheat-manager.pdfIn PDF document text
- http://centuriatus.com/images/roblox-free-clothes-website.pdfIn PDF document text
- https://rincondelentrenador.com/images/how-to-hide-cheat-engine-for-roblox.pdfIn PDF document text
- http://medimacs.eu/images/cheat-engine-62-roblox-mac.pdfIn PDF document text
- http://ctr74.net/images/begone-nerds-roblox-hacking.pdfIn PDF document text
- https://grovehilloutfitters.com/images/roblox-ios-app-hack.pdfIn PDF document text
- https://ghpa.ru/images/free-robux-codes-unused.pdfIn PDF document text
- https://domoticaaplicada.com/images/free-robux-club-com.pdfIn PDF document text
- https://pa-waingapu.go.id/images/robux-hack-pc-2021.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00037d3b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x37D3B	23496 bytes
SHA-256: `f63c04edcae5d07bb12c2dbacccc4b1fe22d3aaaffa85e859c03605e546447c2`
`font_01_sfnt_off0003b219.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3B219	18328 bytes
SHA-256: `631efcf33b3e4739c4fe6bc5e65d15e33d5478e93ef66304974cd0e7096270e0`

Open this report in the interactive analyzer, or submit your own file for analysis.