Malicious PDF — malware analysis report

Static analysis result for SHA-256 120317d6930ac7cd…

MALICIOUS

PDF

61.0 KB Created: 2021-04-06 00:53:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: b955ac6ca9ea2926c1d596d9315ef49c SHA-1: b72d5cd8cd537ed4edf0cab7923a8a73343b4d56 SHA-256: 120317d6930ac7cd790d08463866827ba18dce62ff1bb1f114d8f0ba4028000e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 Malicious Link

The PDF document contains a lure related to 'Roblox' and 'hacking', with a prominent link to 'gaminggenerator.org'. Heuristics indicate brand impersonation (Facebook) and a credential phishing attempt, with the linked host not matching the impersonated brand. The ML classifier also flagged this PDF as malicious. The presence of embedded URLs and the nature of the lure suggest an attempt to redirect users to a malicious site for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/how-to-hack-treasure-hunt-simulator-in-roblox.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-hack-treasure-hunt-simulator-in-roblox PDF link annotation
    • http://www.remiauclair.fr/images/52-000-000-robux-free.pdfIn PDF document text
    • http://behsanroshd.com/images/como-tener-anti-gravedad-en-roblox-hack-check-crashed.pdfIn PDF document text
    • http://aimp-market.ru/images/robux-hacks-admin-commands.pdfIn PDF document text
    • http://sb2m.com.br/images/ash-greninja-free-shopping-in-roblox-on-roblox-shopping.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/roblox-dominus-free-2021.pdfIn PDF document text
    • http://auto-mankel.de/images/hack-roblox-ultimate-driving-dinero-infinito.pdfIn PDF document text
    • http://kids-academy.pl/images/game-on-roblox-where-you-protect-computers-from-being-hacked.pdfIn PDF document text
    • http://mittlenberg.ch/images/bandana-roblox-free.pdfIn PDF document text
    • https://pemadamapi.net/images/how-to-make-a-roblox-dominus-for-free.pdfIn PDF document text
    • http://artindex.pro/images/cheat-roblox-jailbreak-android.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/get-free-roblox-gift-cards.pdfIn PDF document text
    • http://italymania.ru/images/inspect-elements-robux-hack.pdfIn PDF document text
    • https://www.arquetopia.org/images/robux-hack-pc-2021.pdfIn PDF document text
    • http://internetdeputy.com/images/free-robux-gift-card-codes-2021-april.pdfIn PDF document text
    • http://kontaktadig.se/images/roblox-robux-giver-hack-download.pdfIn PDF document text
    • http://amtabor2.at/images/free-robux-for-offers.pdfIn PDF document text
    • http://osteonad.com/images/how-to-hack-people-and-get-their-robux.pdfIn PDF document text
    • http://erntefest2016.de/images/roblox-how-to-get-anything-for-free-2021.pdfIn PDF document text
    • http://asandawireless.co.za/images/roblox-hack-apk-android-1.pdfIn PDF document text
    • http://imp.lg.ua/images/how-to-change-the-script-on-roblox-2021-free-robux.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/redeem-roblox-promotions-free-codes.pdfIn PDF document text
    • http://learningarabic.co.uk/images/how-to-get-free-admin-in-roblox.pdfIn PDF document text
    • http://fratellimazzoleni.it/images/how-to-put-in-hacking-scripts-roblox.pdfIn PDF document text
    • http://www.lionel-seppoloni.fr/images/ninsene-diamon-roblox-hack-key.pdfIn PDF document text
    • https://www.albisser.ch/images/how-to-hack-someone-on-roblox-2021.pdfIn PDF document text
    • http://www.evaplast.by/images/one-piece-millennium-roblox-free-private-server.pdfIn PDF document text
    • https://www.ausecus.com/images/robux-hacks-no-verification-2021.pdfIn PDF document text
    • http://nod74.ru/images/roblox-best-free-t-shirts.pdfIn PDF document text
    • http://musical-arts.de/images/free-robux-2021-april.pdfIn PDF document text
    • https://digitalsenseafrica.com.ng/images/roblox-hack-no-downloading-apps.pdfIn PDF document text
    • https://technospektr.com.ua/images/how-to-hack-roblox-robux-2021.pdfIn PDF document text
    • https://newenglandafs.com/images/roblox-executors-free-download.pdfIn PDF document text
    • https://cluster-consulting.com/images/gun-script-hack-roblox-pastebin-2021.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/how-to-hack-roblox-with-cheat-engine-63.pdfIn PDF document text
    • http://dos.most.gov.la/images/robux-hack-sin-descargar-nada.pdfIn PDF document text
    • http://www.exikom.com.ua/images/how-to-hack-into-roblox-for-robux.pdfIn PDF document text
    • https://vtvvaals.nl/images/roblox-free-skin.pdfIn PDF document text
    • http://pourvosvacances.com/images/are-there-and-free-safe-roblox-exploits-v3rmillion.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/how-to-earn-free-robux-on-ipad.pdfIn PDF document text
    • http://fa-deco.com/images/roblox-games-that-will-give-you-free-robux.pdfIn PDF document text
    • http://alexanderautos.co/images/como-hackear-roblox-pushing.pdfIn PDF document text
    • http://amtabor2.at/images/how-to-make-shirts-on-roblox-for-free.pdfIn PDF document text
    • http://legs11.co.za/images/how-to-get-roblox-mod-menu-free.pdfIn PDF document text
    • http://dialine.cz/images/roblox-guess-the-famous-characters-answers-cheat-sheets.pdfIn PDF document text
    • http://stackideas.com/images/roblox-obc-lifetime-free.pdfIn PDF document text
    • https://www.brainpads.com/images/proxy-site-free-robux.pdfIn PDF document text
    • http://www.apocalissedigesucristo.com/images/how-to-draw-on-free-draw-roblox.pdfIn PDF document text
    • http://kids-academy.pl/images/how-to-get-hacks-in-island-life-roblox.pdfIn PDF document text
    • http://auto-mankel.de/images/how-to-get-sypnase-for-free-roblox.pdfIn PDF document text
    +19 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000083fc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x83FC 26212 bytes
SHA-256: 01ddaf663855d11d5b6a03a77c74bd493624d39d7e840407c370229f963477ec
font_01_sfnt_off0000bfb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFB9 2848 bytes
SHA-256: 4737c2778a085e0cb49e73f3b054b1a71e3f40720d213b4bfda97f95a31bfbf1
font_02_sfnt_off0000c97a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC97A 18696 bytes
SHA-256: c8a164574668aa645b102c37c1c49701608008a377c60b5a751a60279b2090bb

Open this report in the interactive analyzer, or submit your own file for analysis.