Malicious PDF — malware analysis report

Static analysis result for SHA-256 0aa0a3135d19e8fb…

MALICIOUS

PDF

40.4 KB Created: 2021-04-03 10:35:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: a801daa3206fbcb73db2c50e999762ff SHA-1: 4537b3ccaf271c0c2df69e882655efc5fd9d5eb7 SHA-256: 0aa0a3135d19e8fb4bf3d794f211994974e79264bbe991c1546c3904c649702e
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links to websites that claim to offer game hacks and free in-game currency, such as Robux. The heuristic 'PDF_GAME_HACK_LINK_FARM' indicates a collection of such lures, and the ML classifier flagged the document as malicious. The embedded URLs likely lead to phishing sites or downloaders for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 4

  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-get-5-free-robux-doing-nothing PDF link annotation
    • https://www.romedia.gr/images/how-to-hack-a-roblox-game-2021.pdfIn PDF document text
    • https://www.iadh.bi/images/free-code-roblox-card-with-no-risk.pdfIn PDF document text
    • http://www.rezbb.sk/images/vehicle-tycoon-roblox-hacks.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/roblox-build-a-boat-for-treasure-money-hack.pdfIn PDF document text
    • https://corbo.ru/images/yt-roblox-free-roubux.pdfIn PDF document text
    • http://www.actae.gr/images/roblox-invincibility-cheat.pdfIn PDF document text
    • https://www.seeingindependence.org/images/how-to-get-free-robux-2021-not-fake.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/roblox-how-to-get-any-item-for-free.pdfIn PDF document text
    • http://pa-tanjungselor.go.id/images/how-to-get-free-robux-2021-hack.pdfIn PDF document text
    • http://sscclc.edu.ec/images/roblox-free-gift-card-generator.pdfIn PDF document text
    • https://sitam.co.in/images/how-to-hack-roblox-apocalypse-rising-2021.pdfIn PDF document text
    • http://cosver.eu/images/free-robux-card-codes-2021-december.pdfIn PDF document text
    • http://www.web.stc-part.co.th/images/free-pin-numbers-for-gift-cards-for-roblox.pdfIn PDF document text
    • http://cosver.eu/images/cheat-codes-for-aquaman-roblox-promo.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/free-roblox-promo-codes-for-robux.pdfIn PDF document text
    • https://www.sinaloadiario.mx/images/free-robux-hack-us-2021.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/free-roblox-promo-codes-2021-july.pdfIn PDF document text
    • https://sitam.co.in/images/free-robux-map-uncopylocked.pdfIn PDF document text
    • http://www.copoint.co.uk/images/hack-roblox-dll.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/any-free-stuff-on-roblox.pdfIn PDF document text
    • http://www.occquimica.com.br/images/100-real-robux-hack.pdfIn PDF document text
    • http://www.torvet11.dk/images/hacks-for-free-animations-roblox.pdfIn PDF document text
    • https://www.iadh.bi/images/how-to-have-a-mad-city-roblox-hack.pdfIn PDF document text
    • https://tokunfome.com.br/images/robux-hack-pastebin-working.pdfIn PDF document text
    • https://www.lavigny.ch/images/free-roblox-bloxburg.pdfIn PDF document text
    • http://nevesomost.by/images/free-roblox-accounts-with-robux-september-2021.pdfIn PDF document text
    • http://www.marambio.com.ar/images/free-roblox-outfits-for-avatar.pdfIn PDF document text
    • http://www.mikramarine.gr/images/how-to-get-free-dimonds-in-roblox-royle-high-shool.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/free-items-roblox-codes.pdfIn PDF document text
    • http://www.occquimica.com.br/images/hack-roblox-youtube.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000458e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x458E 23248 bytes
SHA-256: 85f64bded0333303537d37cb6651477d699123dc4e6c060f3d6693b31677fa31
font_01_sfnt_off000079d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79D1 18552 bytes
SHA-256: 029e00cdb342d0b47719d52c9e0b325dcdeb59b9f7574fffa252e58120ccc4e7

Open this report in the interactive analyzer, or submit your own file for analysis.