Malicious PDF — malware analysis report

Static analysis result for SHA-256 11748a36a2a47b7a…

MALICIOUS

PDF

53.1 KB Created: 2021-04-06 08:58:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-14
MD5: b71337b770becb992653736c8ec0b685 SHA-1: 9a87cba59fe90e95f984ddad2c518ddbc0ed7ed7 SHA-256: 11748a36a2a47b7a5e5110fb6319c0ef3201f3b841246124cd8a241d870fb568
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains multiple links disguised as game hacks and free currency generators, specifically targeting Roblox players. The primary lure, 'enigmagenerator.com/app/431946152/roblox-game-hack', strongly suggests a phishing or malware distribution attempt. The presence of a visual download button further supports the malicious intent of directing users to external, potentially harmful, content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8721

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://ekaterinakorneva.com/images/bandit-roblox-exploiter-for-free.pdfIn PDF document text
    • https://www.hotschool.com.au/images/hack-para-destruir-en-roblox.pdfIn PDF document text
    • https://www.u-pin-it.com/images/como-hackear-roblox-2021-en-android.pdfIn PDF document text
    • http://agrupamentoescolas-alfredo-da-silva.com/images/how-to-access-the-float-hack-in-roblox.pdfIn PDF document text
    • https://sdg-trade.com/images/hydra-roblox-game-that-gives-free-robux.pdfIn PDF document text
    • http://atelierweb.it/images/free-robux-youtube-pastebin.pdfIn PDF document text
    • http://forsan.edu.eg/images/hack-mad-city-roblox-descargar.pdfIn PDF document text
    • http://io24.com.ar/images/roblox-robux-exploit-hack.pdfIn PDF document text
    • http://abqwinair.com/images/roblox-hack-no-survey-2021.pdfIn PDF document text
    • http://ivalor.fr/images/roblox-how-to-get-free-vip-servers.pdfIn PDF document text
    • https://hbln.org.au/images/money-money-roblox-free-catalog.pdfIn PDF document text
    • https://bdhcpa.com/images/roblox-fly-script-cheat-engine.pdfIn PDF document text
    • https://invertsports.com/images/roblox-credit-card-payment-hack.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/rbxvault-free-robux.pdfIn PDF document text
    • http://agrao.in/images/roblox-bc-free-2021.pdfIn PDF document text
    • http://cosver.eu/images/doge-roblox-free.pdfIn PDF document text
    • https://beejekorf.nl/images/codes-free-robux-on-bloxland-youtube.pdfIn PDF document text
    • https://www.mrsz.ir/images/how-to-make-roblox-hack-scripts.pdfIn PDF document text
    • https://yarburservices.ru/images/free-aand-true-ways-to-get-robux.pdfIn PDF document text
    • https://liceucastrodelapenya.com/images/roblox-the-conquerors-hack.pdfIn PDF document text
    • http://bc97.de/images/roblox-hack-client-free.pdfIn PDF document text
    • http://abletrustcare.com/images/cool-roblox-shirts-free-shipping.pdfIn PDF document text
    • http://seniornetwanganui.org.nz/images/how-use-pabestin-codes-hack-roblox.pdfIn PDF document text
    • https://asesoriamss.com/images/earn-robux-by-hacking-2021.pdfIn PDF document text
    • http://junktiquecollector.com/images/free-clothes-catalog-roblox.pdfIn PDF document text
    • http://www.evaplast.by/images/hack-script-fame-simulator-roblox.pdfIn PDF document text
    • http://aiyta.com/images/copy-and-paste-for-free-robux.pdfIn PDF document text
    • http://www.equistop.it/images/how-to-get-free-robux-2021-website.pdfIn PDF document text
    • https://www.stkdb.cz/images/free-roblox-exploi.pdfIn PDF document text
    • https://avn.kz/images/hack-roblox-ios.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/free-robux-ios-2021-no-human-verification.pdfIn PDF document text
    • http://mmech.com/images/abstract-hack-roblox.pdfIn PDF document text
    • https://www.osoc.com/images/pastebin-com-raw-free-robux.pdfIn PDF document text
    • http://uptodate.az/images/roblox-murder-mystery-2-hack-script-pastebin.pdfIn PDF document text
    • http://sports-service.com/images/dbz-galaxy-burst-roblox-cheats.pdfIn PDF document text
    • https://www.mrsz.ir/images/can-you-earn-robux-for-free.pdfIn PDF document text
    • http://learningarabic.co.uk/images/i-want-to-break-free-roblox-id.pdfIn PDF document text
    • https://meltonschool.org/images/cheat-engine-roblox-tycoon-2021.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/best-script-for-hacking-roblox.pdfIn PDF document text
    • https://waterpark.by:443/images/infinite-money-hack-for-roblox.pdfIn PDF document text
    • http://forsazh-51.ru/images/acop-roblox-hack.pdfIn PDF document text
    • https://jdlgroup.ca/images/awesome-roblox-hacks.pdfIn PDF document text
    • http://bilhetim.com.br/images/hack-de-robuxs-2021.pdfIn PDF document text
    • http://citycare.pt/images/dead-winter-roblox-hack.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/roblox-builders-club-free-trial-2021.pdfIn PDF document text
    • http://nevesomost.by/images/jamaica-roblox-free-robux.pdfIn PDF document text
    • https://inspiration-modellbau.de/images/free-vip-server-for-speed-race-game-roblox.pdfIn PDF document text
    • https://verdensbarn.no/images/can-u-get-hacked-through-roblox.pdfIn PDF document text
    • http://classicskitours.net/images/how-to-get-free-robux-card-codes-2021.pdfIn PDF document text
    +13 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006edd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6EDD 26088 bytes
SHA-256: 02531a3564a8567b7d465c80d19e4835e73cddae44deaeaaca093e9129f7e520
font_01_sfnt_off0000aa9a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAA9A 18716 bytes
SHA-256: 7d8a8d0e9968fc617c42ee31be31218cf3da970460857390554f0633d7a60d4c

Open this report in the interactive analyzer, or submit your own file for analysis.