Malicious PDF — malware analysis report

Static analysis result for SHA-256 110020d417baca0a…

MALICIOUS

PDF

58.8 KB Created: 2021-04-05 21:05:21 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 622474a04d0792fb4dba7a04d7275c34 SHA-1: 1d07d56204858b4e522d585953b514eba3d66f14 SHA-256: 110020d417baca0a3a1f0d9d3eff1af9ee6731c5478fc51a8d72573e4d193e65
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous links and text related to "free Robux" and "hacks" for the game Roblox, indicating a scam or phishing attempt. The heuristic firings confirm the presence of a "game-hack scam link farm" and "external URIs" pointing to these lures. The document body is heavily populated with these malicious URLs, reinforcing the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-roblox-robux-accounts-2021 PDF link annotation
    • https://wandersuechtig.de/images/want-free-robux-copy-and-paste.pdfIn PDF document text
    • http://jdlrelocation.com/images/how-to-cheat-on-roblox-got-talent.pdfIn PDF document text
    • http://moralcenter.or.th/images/how-to-get-money-for-free-on-adopt-me-roblox.pdfIn PDF document text
    • http://algierimasonry.com/images/prison-life-roblox-hack-download-tablet.pdfIn PDF document text
    • http://demenagementlandry.com/images/cheat-roblox-lumber-tycoon-2-axe.pdfIn PDF document text
    • http://www.bernerpupping.at/images/como-hackear-cuentas-de-roblox-espaol.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/keneco-kitten-says-roblox-hack.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/can-you-get-alone-for-free-roblox.pdfIn PDF document text
    • http://eventoslanoria.com/images/free-robux-app-without-human-verification.pdfIn PDF document text
    • http://fiur-malermeister.de/images/download-roblox-music-for-free.pdfIn PDF document text
    • https://www.audipec.com.br/images/how-do-you-hack-a-roblox-account.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/hex-number-gives-free-robux.pdfIn PDF document text
    • http://iacovoulaw.com/images/robux-hack-without-verification-required.pdfIn PDF document text
    • https://www.romedia.gr/images/irobux-fun-robux-hack.pdfIn PDF document text
    • https://sdg-trade.com/images/cheats-for-jailbreak-roblox.pdfIn PDF document text
    • http://abqwinair.com/images/roblox-hack-robber-simulator.pdfIn PDF document text
    • http://jaeger-bauplanung.de/images/roblox-gift-card-codes-2021-free.pdfIn PDF document text
    • https://domoticaaplicada.com/images/roblox-hack-accounts-password-2021.pdfIn PDF document text
    • https://septik-montag.ru/images/all-game-roblox-admin-gui-hack-working.pdfIn PDF document text
    • http://lv-siegen.de/images/the-only-working-way-to-get-free-robux.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/free-robux-by-bananaman-2021.pdfIn PDF document text
    • https://gaj.rs/images/draw-it-roblox-hack.pdfIn PDF document text
    • http://www.anies.eu/images/free-aimbot-hacks-for-roblox.pdfIn PDF document text
    • https://blagvist.com.ua/images/cheat-roblox-kick-player-2021.pdfIn PDF document text
    • http://www.anies.eu/images/robux-code-hack-2021.pdfIn PDF document text
    • https://bancroftandsons.com/images/how-to-get-free-robux-no-hack-or-download-2021.pdfIn PDF document text
    • https://kimolos-link.gr/images/how-to-get-free-robux-money-on-roblox.pdfIn PDF document text
    • http://ilifemarket.ru/images/roblox-ninja-legends-cheat-engine.pdfIn PDF document text
    • http://www.visiblefilm.com/images/what-is-bad-about-roblox-free-models.pdfIn PDF document text
    • https://socialvalue.gr/images/this-exploit-hack-has-been-developed-by-ak47-roblox.pdfIn PDF document text
    • https://septik-montag.ru/images/how-to-hack-roblox-accounts-with-cheat-engine-2021.pdfIn PDF document text
    • http://selectionspdf.fr/images/getgaming-resources-roblox-hack.pdfIn PDF document text
    • http://w-i-r.de/images/como-hackear-cualquier-cuenta-en-roblox.pdfIn PDF document text
    • http://www.les2alpes-location.com/images/killa-in-kalahari-sirius-mashup-copyright-free-roblox.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/free-dominus-roblox-code.pdfIn PDF document text
    • http://salantiskis.lt/images/generate-free-robux-gnome.pdfIn PDF document text
    • https://www.linzgau-kjh.de/images/unicorn-cheat-in-roblox.pdfIn PDF document text
    • http://energotestcontrol.ru/images/roblox-free-download-windows-7.pdfIn PDF document text
    • http://www.inservis.cl/images/online-roblox-hack-2021.pdfIn PDF document text
    • http://hondenspecialist-engelien.nl/images/a-tab-that-can-get-robux-for-free.pdfIn PDF document text
    • http://www.remiauclair.fr/images/awesome-roblox-outfits-for-free.pdfIn PDF document text
    • https://www.devries-group.de/images/roblox-robux-hack-computer.pdfIn PDF document text
    • http://portal.crfsp.org.br/images/how-to-wall-hack-in-roblox-after-patch.pdfIn PDF document text
    • http://kancelaria-legnica.eu/images/ant-roblox-jailbreak-teleport-hack.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/how-to-make-free-pants-on-roblox.pdfIn PDF document text
    • http://baah.ca/images/hacks-for-roblox-map-kat.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/roblox-is-there-any-hacks-that-avast-antivirus-allows.pdfIn PDF document text
    • https://www.romedia.gr/images/roblox-free-gamepass-script-pastebin.pdfIn PDF document text
    • http://technologicalsc.com/images/roblox-denisdaily-shirt-free.pdfIn PDF document text
    +21 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008224.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8224 27784 bytes
SHA-256: 8d92a5da56585fe5ece2c2ccad1aba9b5eee309e16bfa3389fbea68c151def16
font_01_sfnt_off0000c26c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC26C 18320 bytes
SHA-256: 56d7a9a38f6874d3fde5b402c3c6a2f68cf58f0fc037ecbdfca4b2722b930db8