Malicious PDF — malware analysis report

Static analysis result for SHA-256 118fd0c891f3fe6b…

MALICIOUS

PDF

244.1 KB Created: 2021-04-04 10:26:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 02905c1da3c48b4901023fbda7ca2c90 SHA-1: 7a0b49b7accbbc39e816939793a65c2ca694e32b SHA-256: 118fd0c891f3fe6b75df91d0126649c7ae2c365d939e1f99519fd89a5f0d56f8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV. The file presents a deceptive download button and uses an image-based lure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier clean score 0.1227

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 244 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-robux-apk-modapkdown PDF link annotation
    • https://reggieslockandkey.com/images/free-reedeem-codes-roblox.pdfIn PDF document text
    • http://sb2m.com.br/images/ash-greninja-free-shopping-in-roblox-on-roblox-shopping.pdfIn PDF document text
    • https://corbo.ru/images/good-softwares-to-hack-roblox.pdfIn PDF document text
    • http://racunari.in.rs/images/pastebin-roblox-cheats.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/descargar-hack-roblox-robux.pdfIn PDF document text
    • https://newenglandafs.com/images/hack-piano-roblox-mobile-download.pdfIn PDF document text
    • http://vipservice-bg.com/images/epic-free-robux.pdfIn PDF document text
    • http://vagency.us/images/hack-for-robux-roblox.pdfIn PDF document text
    • http://loszavera.com/images/hacked-roblox-song-id.pdfIn PDF document text
    • http://www.rezbb.sk/images/ninja-simulator-roblox-cheats-for-xbox.pdfIn PDF document text
    • http://www.htc.edu.au/images/how-can-we-get-robux-for-free.pdfIn PDF document text
    • http://xn-----clcdhzcbmgnochhb1boe1a6b.xn--p1ai/images/icon-free-robux.pdfIn PDF document text
    • http://www.evaplast.by/images/hacks-for-speed-simulator-2-roblox.pdfIn PDF document text
    • http://pgk-polaniec.pl/images/roblox-building-simulator-hack.pdfIn PDF document text
    • http://soma.com.ua/images/free-robux-form-hectic-plays.pdfIn PDF document text
    • https://servotecnica.com/images/free-robux-codes-on-tablet-2021.pdfIn PDF document text
    • http://instrumenttut.by/images/free-robux-hack-mobile.pdfIn PDF document text
    • https://cdu-lengerich.de/images/roblox-shinobi-life-cheat-engine-spins.pdfIn PDF document text
    • https://gryps.de/images/safe-free-robux-no-password-or-human-verification.pdfIn PDF document text
    • http://www.centromedicoaurora.it/images/robux-money-for-free.pdfIn PDF document text
    • https://grovehilloutfitters.com/images/the-conquerors-roblox-hacked.pdfIn PDF document text
    • https://www.millatgears.com/images/robux-generator-free-no-password.pdfIn PDF document text
    • http://www.prylfabriken.se/images/free-robux-2021-wiki.pdfIn PDF document text
    • https://ghpa.ru/images/free-robux-inspecting-method.pdfIn PDF document text
    • https://www.saisystem.it/images/free-items-roblox-2021-hack.pdfIn PDF document text
    • http://goldwing-shop.ru/images/roblox360com-free-robux.pdfIn PDF document text
    • http://fa-deco.com/images/pastebin-roblox-vip-free-robux-no-wait.pdfIn PDF document text
    • https://www.ausecus.com/images/phantom-forces-roblox-hack-2021.pdfIn PDF document text
    • http://eleveurs-autrement.fr/images/free-roblox-accounts-with-no-robux.pdfIn PDF document text
    • http://papec.ir/images/how-to-hack-roblox-accounts-2021-december.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00037eaa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37EAA 19052 bytes
SHA-256: 5543e924abf6c07baf56a976dcf46b5ece2119a52d257f2da7c83df5355f98c2
font_01_sfnt_off0003a6ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A6AD 18516 bytes
SHA-256: 379a817c96f94d51abcd9b80c614da5751ad52c39a026af48ab2ff252e8665e1

Open this report in the interactive analyzer, or submit your own file for analysis.