Malicious PDF — malware analysis report

Static analysis result for SHA-256 120c02938260706d…

MALICIOUS

PDF

240.6 KB Created: 2021-04-05 03:07:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 58cc0d61f183dd84418e66eb79645ddd SHA-1: cf4a29905078cee76ed17bbaee45d493a1114258 SHA-256: 120c02938260706d3c0ddad3f922a1ff0cbda137e29112cea17c61852ec78ccd
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically identified as 'Pdf.Phishing.Roblox062100-9873116-0'. It contains embedded URLs and a visual download button, suggesting a phishing or scam attempt related to Roblox hacks. The presence of external URIs like http://gaminggenerator.org/app/431946152/roblox-admin-hack-pastebin further supports this, indicating a likely attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5773

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-admin-hack-pastebin PDF link annotation
    • https://www.sauvonsleclimat.org/images/roblox-snow-shoveling-simulator-free-santa-bag-inf.pdfIn PDF document text
    • http://fairwaygolftravel.co.uk/images/claim-free-robux-no-survey.pdfIn PDF document text
    • http://akademiatenisa.org/images/hack-para-roblox-flood-escape-2.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/roblox-adopt-me-building-hacks.pdfIn PDF document text
    • http://serviio.org/images/how-to-get-your-hacked-roblox-account-back.pdfIn PDF document text
    • http://italymania.ru/images/hacks-for-undertale-boss-3d-fights-roblox.pdfIn PDF document text
    • http://schottlandfieber.de/images/free-robux-ads-that-are-played-on-youtube.pdfIn PDF document text
    • http://ghegamethu.vn/images/funnest-roblox-script-to-hack-games.pdfIn PDF document text
    • https://bancroftandsons.com/images/how-to-hack-into-roblox-groups.pdfIn PDF document text
    • https://www.eglihotel.gr/images/roblox-tokyo-ghoul-project-killzone-hack.pdfIn PDF document text
    • http://pgk-polaniec.pl/images/how-to-hack-roblox-accounts-2021-mobile.pdfIn PDF document text
    • http://musical-arts.de/images/how-to-get-a-roblox-mad-city-money-hack.pdfIn PDF document text
    • http://www.maakherumusic.net/images/what-is-the-best-free-roblox-exploit.pdfIn PDF document text
    • https://gzog.pl/images/cheats-for-getting-money-in-roblox-meep-city.pdfIn PDF document text
    • https://bdsm-centrum.com/images/roblox-hack-robux-2021-unlimited-robux-and-tix.pdfIn PDF document text
    • http://pia2000.net/images/free-accounts-that-have-robux.pdfIn PDF document text
    • http://hk-kan.org/images/free-roblox-sun-glasses.pdfIn PDF document text
    • http://bullyinformate.org/images/roblox-tycoon-hack-script.pdfIn PDF document text
    • http://jbm-constructions.com/images/free-username-and-password-in-roblox.pdfIn PDF document text
    • https://www.arquetopia.org/images/roblox-hack-for-android-apk.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036c0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36C0A 21664 bytes
SHA-256: 7c5d99136f75da1b09fab81a5fe14608823bc9a7b0c77dda2ad53ca880844019
font_01_sfnt_off00039b82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39B82 18564 bytes
SHA-256: a38881cc1e0bf6923244c7b311639bacb58cf28d10a34677a529967bfd08da74