Malicious PDF — malware analysis report

Static analysis result for SHA-256 15d3d95d302a54e8…

MALICIOUS

PDF

245.5 KB Created: 2021-04-05 03:59:50 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-23
MD5: e9360fd21affb2d92567729e9149b919 SHA-1: ecbe6e72840ed4bd495c13869268b60e2a75d820 SHA-256: 15d3d95d302a54e84d20f48947a900644b755f05c61504854670b68edaeebb7a
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified by ClamAV as 'Pdf.Phishing.Roblox062100-9873116-0', indicating a phishing lure related to Roblox. It contains an external URI pointing to 'http://gaminggenerator.org/app/431946152/roblox-2all-site-hack', likely the download location for a malicious payload. The document body is heavily obfuscated, preventing a detailed analysis of its specific content or embedded scripts.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2693

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-2all-site-hack PDF link annotation
    • http://britishcomics.com/images/how-to-unlock-blocks-cheat-in-lucky-blocks-in-roblox.pdfIn PDF document text
    • http://mostowicz.pl/images/how-to-get-a-hacked-account-on-roblox.pdfIn PDF document text
    • http://moralcenter.or.th/images/free-black-wings-roblox.pdfIn PDF document text
    • http://horsa18.ru/images/roblox-hack-download-unlimited-robux.pdfIn PDF document text
    • http://farwesterndistrict.org/images/free-robux-hack-us-2021.pdfIn PDF document text
    • http://akademiatenisa.org/images/earn-free-robux-for-roblox.pdfIn PDF document text
    • http://www.elis-strechy.cz/images/hack-de-prision-life-en-roblox.pdfIn PDF document text
    • https://gomsa.nl/images/roblox-how-to-get-free-robux-without-builders-club.pdfIn PDF document text
    • http://smart-pro.co.uk/images/javascript-roblox-free-robux.pdfIn PDF document text
    • http://www.boic.nl/images/hacks-para-arsenal-roblox-tampermonkey.pdfIn PDF document text
    • http://citycare.pt/images/free-robux-no-server.pdfIn PDF document text
    • https://yarburservices.ru/images/insane-jailbreak-roblox-admin-panel-hack-working.pdfIn PDF document text
    • http://eooe.gr/images/how-to-hack-a-roblox-account-password-2021.pdfIn PDF document text
    • http://palogar.es/images/roblox-its-free-2021.pdfIn PDF document text
    • http://zibai.eu/images/free-robux-pain-exist.pdfIn PDF document text
    • http://lllaw.eu/images/roblox-robux-hack-ios.pdfIn PDF document text
    • http://kermas.eu/images/hack-roblox-a-telecharger-gratuit-pour-jailbreak.pdfIn PDF document text
    • http://androidthai.in.th/images/monkey-free-robux.pdfIn PDF document text
    • https://hbpbenin.com/images/rbxboost-earn-free-roblox.pdfIn PDF document text
    • http://www.prylfabriken.se/images/free-cool-stuff-on-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00037a6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37A6D 24368 bytes
SHA-256: cd8237b471d8cd93e6d08be6e0baed341950f1a15c7766593b8d187aeaa0ca4d
font_01_sfnt_off0003b0f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B0F7 17748 bytes
SHA-256: c82fe8f7e9ecb2fe84242711cab0b24327691c7f442494be2f485cf8b450cd61