PDF static analysis report

Static analysis result for SHA-256 192bdb6eebc676d9…

SUSPICIOUS

PDF

39.7 KB Created: 2021-04-03 20:44:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 392798ed06f9a4511541606f995581c0 SHA-1: e9205f13db0d7cbae24577a9159e54de4eba7c7c SHA-256: 192bdb6eebc676d92b524e1add5fb6e37ef82d92d4938b94f5e5c50bd1520445
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a prominent external URI pointing to sites offering 'Roblox cheat engine download' and 'free Robux'. The ML classifier also flagged this PDF as malicious. While no scripts were directly extracted, the presence of numerous links to potentially unwanted or malicious software, combined with the lure of game cheats, strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-cheat-engine-download-no-survey PDF link annotation
    • https://www.hotschool.com.au/images/hoe-to-get-free-robux-2021.pdf%0AIn PDF document text
    • http://www.drent.se/images/roblox-hack-no-survey.pdf%0AIn PDF document text
    • https://ballaratcaravans.com.au/images/free-roblox-without-verification.pdf%0AIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/roblox-free-items-games.pdf%0AIn PDF document text
    • https://www.hbproducts.dk/images/roblox-mobile-hacks-4-free-com.pdf%0AIn PDF document text
    • http://salantiskis.lt/images/how-to-find-hacker-accounts-on-roblox.pdf%0AIn PDF document text
    • https://corbo.ru/images/how-to-get-free-money-on-roblox-retail-tycoon.pdf%0AIn PDF document text
    • http://www.tamogatoweb.hu/images/roblox-unban-hack.pdf%0AIn PDF document text
    • https://www.beaufortcollege.ie/images/roblox-infinite-jump-hack-2021.pdf%0AIn PDF document text
    • https://jdlgroup.ca/images/island-royale-roblox-hacks.pdf%0AIn PDF document text
    • http://gops.pruszczgdanski.pl/images/how-to-hack-money-on-tycoons-on-roblox.pdf%0AIn PDF document text
    • http://portal.crfsp.org.br/images/how-to-run-lua-script-roblox-hacks.pdf%0AIn PDF document text
    • https://www.romedia.gr/images/how-to-get-free-shirt-in-roblox-2021.pdf%0AIn PDF document text
    • https://verdensbarn.no/images/counter-roblox-offensive-hacks.pdf%0AIn PDF document text
    • http://www.nielsen2u.dk/images/roblox-how-to-get-free-robux-real.pdf%0AIn PDF document text
    • http://dos.most.gov.la/images/free-money-generator-cbr-roblox.pdf%0AIn PDF document text
    • http://escolaarboc.cat/images/free-printable-roblox-miniature-chocolate.pdf%0AIn PDF document text
    • http://www.htc.edu.au/images/roblox-dolphin-hacks.pdf%0AIn PDF document text
    • https://www.milewood.co.uk/images/how-to-free-robux-on-ipad.pdf%0AIn PDF document text
    • http://uctovnictvosnv.sk/images/roblox-free-robux-glitch.pdf%0AIn PDF document text
    • http://www.gadanie.lv/images/free-roblox-level-7-script-executor.pdf%0AIn PDF document text
    • http://gops.pruszczgdanski.pl/images/dll-dor-roblox-hacks.pdf%0AIn PDF document text
    • http://www.occquimica.com.br/images/dragon-ball-z-roblox-training-hack.pdf%0AIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/free-robux-codes-october-2021.pdf%0AIn PDF document text
    • http://bilhetim.com.br/images/script-hack-for-roblox.pdf%0AIn PDF document text
    • https://www.romedia.gr/images/how-to-hack-peoples-accounts-on-roblox-2021.pdf%0AIn PDF document text
    • https://www.najeebqasmi.com/images/cheat-code-for-roblox-theme-park.pdf%0AIn PDF document text
    • http://www.drent.se/images/roblox-cheat-comands.pdf%0AIn PDF document text
    • http://agroturismoarkaia.com/images/how-to-hack-a-roblox-account-using-cookies.pdf%0AIn PDF document text
    • https://www.lavigny.ch/images/hacks-for-blood-flow-roblox.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000043a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x43A5 22324 bytes
SHA-256: dc544dba6e7fa8989591815c0c0484ac5109435d2e159af792a11f3ff34aec45
font_01_sfnt_off0000753f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x753F 19024 bytes
SHA-256: 5e20a760e0ffa809a7373bef3ca8edf29d70986ed5ce1edeb90e59306d8f3c5a