Malicious PDF — malware analysis report

Static analysis result for SHA-256 115f13caeb42f641…

MALICIOUS

PDF

54.7 KB Created: 2021-04-07 04:54:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-18
MD5: e16678d37d8191a50f69fb92c0203205 SHA-1: cfd6251b1ae2116ca7b4274da340d765749247b8 SHA-256: 115f13caeb42f6417aa5ed8bcbcc816def4897488d96120c33587327b33f0a79
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8220

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://dottgagliardi.com/images/roblox-item-free-2021.pdfIn PDF document text
    • https://ceranique.nl/images/free-roblox-gift-card-pins.pdfIn PDF document text
    • http://www.evaplast.by/images/how-to-use-cheat-engine-in-roblox-2021.pdfIn PDF document text
    • http://ruksnaitis.com/images/how-to-hack-roblox-to-get-free-money-jailbreak.pdfIn PDF document text
    • http://medinup.pt/images/roblox-vermillion-free-level-7.pdfIn PDF document text
    • http://jasperfirstumc.com/images/roblox-play-as-geust-for-free.pdfIn PDF document text
    • https://gabrieliassociati.com/images/get-free-robux-by-downloading-apps.pdfIn PDF document text
    • https://www.cpnf.ch/images/are-games-on-roblox-free-to-make.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/roblox-rap-battles-hack.pdfIn PDF document text
    • https://laconce.com/images/free-clothes-of-roblox.pdfIn PDF document text
    • http://pechativmoskve.ru/images/teleport-hack-roblox-jailbreak.pdfIn PDF document text
    • http://dorfgaragethalwil.ch/images/roblox-free-catalog-item.pdfIn PDF document text
    • http://damvallei.be/images/wwwrobloxcheat-de.pdfIn PDF document text
    • http://teknotools.net/images/roblox-deep-space-tycoon-hack-script.pdfIn PDF document text
    • http://laplazuelacafe.com/images/roblox-free-login-and-password.pdfIn PDF document text
    • http://safari-crimea.com/images/how-to-hack-into-peoples-accounts-on-roblox-2021.pdfIn PDF document text
    • https://www.ferienhausdirektkroatien.de/images/how-to-get-free-cute-clothes-on-roblox.pdfIn PDF document text
    • https://shimony.net/images/adopt-me-roblox-building-hacks.pdfIn PDF document text
    • https://www.utalii.ac.ke/images/robux-hack-code-pastebin.pdfIn PDF document text
    • http://cruzdelsur.ru/images/how-to-hack-games-in-roblox-on-ipad.pdfIn PDF document text
    • http://clubpure.org/images/how-to-give-items-on-roblox-for-free.pdfIn PDF document text
    • https://lita-lb.org/images/how-to-get-free-robux-no-wait-works-proof.pdfIn PDF document text
    • http://smartint.com.my/images/arcade-tycoon-hack-roblox.pdfIn PDF document text
    • http://fccsms.com/images/hacking-on-roblox-c00lkidd.pdfIn PDF document text
    • http://palogar.es/images/free-robux-read-desc.pdfIn PDF document text
    • http://techmobil.pl/images/how-to-get-free-robux-easiest-way-september-2021-yummers.pdfIn PDF document text
    • https://www.mdou69.ru/images/vouchers-to-get-free-robux-2021.pdfIn PDF document text
    • https://www.plumbermedics.com/images/roblox-mod-apk-free-shopping.pdfIn PDF document text
    • https://luminouswisdom.org/images/videos-for-free-robux.pdfIn PDF document text
    • http://www.cosver.nl/images/speed-hack-for-every-game-in-roblox.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/free-robux-generator-mac.pdfIn PDF document text
    • http://rumler.pl/images/how-to-hack-roblox-passwords-2021.pdfIn PDF document text
    • http://www.actae.gr/images/roblox-injector-hack-2021-synpnese.pdfIn PDF document text
    • http://ghhs.com.my/images/roblox-free-gift.pdfIn PDF document text
    • http://reisebild.eu/images/muscles-legends-roblox-script-hack-pastebin.pdfIn PDF document text
    • http://arkivthy.dk/images/free-robux-generator-no-download-no-surveys-2021.pdfIn PDF document text
    • https://pa-pangkalpinang.go.id/images/roblox-games-that-give-you-free-items-2021.pdfIn PDF document text
    • http://www.actae.gr/images/comment-hacker-robux-sur-telephone.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/free-exsotic-cdes-in-roblox-assain.pdfIn PDF document text
    • https://www.ncscolour.no/images/star-codes-free-robux.pdfIn PDF document text
    • https://www.tsdb.com.au/images/hacks-admin-roblox.pdfIn PDF document text
    • https://www.seeingindependence.org/images/top-free-commands-in-roblox-which-works-in-all-games.pdfIn PDF document text
    • http://soma.com.ua/images/how-to-install-free-song-to-roblox.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/play-this-game-to-get-free-robux.pdfIn PDF document text
    • http://www.flotom.at/images/roblox-dinosaur-simulator-free.pdfIn PDF document text
    • http://loszavera.com/images/free-robux-no-wait-2021.pdfIn PDF document text
    • https://masseymotorcars.com/images/robuxian-robux-hack-website.pdfIn PDF document text
    • https://semanasantacehegin.com/images/roblox-free-model-virus.pdfIn PDF document text
    • https://www.romedia.gr/images/how-to-get-free-robux-on-phone-easy.pdfIn PDF document text
    +17 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007069.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7069 27620 bytes
SHA-256: 9dfb02316eb4767b9f7af4bcc2990625c806cef437953056bf32012970cf5680
font_01_sfnt_off0000b02d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB02D 18956 bytes
SHA-256: 5fb266afa275da61440ad05d8509aeab7fad8f6030c2eb218cdc741659654612

Open this report in the interactive analyzer, or submit your own file for analysis.