Malicious PDF — malware analysis report

Static analysis result for SHA-256 25925699d47bb860…

MALICIOUS

PDF

54.7 KB Created: 2021-04-05 18:03:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-14
MD5: a070f9a7ab9545eec7239e92f9289fb3 SHA-1: 1d3839c9cda1ea5506255532aae1b5df3e9c8ec8 SHA-256: 25925699d47bb860edeade7a3c73015151cf94004dcf1a9a6719f6b57ca7837e
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, many of which are repeated and disguised as download buttons or related to game cheats. The heuristic 'PDF_REPEATED_PAYLOAD_LINK_LURE' specifically indicates that these invisible links are intended to deliver a payload. The document body and extracted URLs suggest a lure related to 'Robux' generators and game hacks, aiming to trick users into downloading malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6365

Heuristics 3

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/vido-roblox-free-robux-generator.com In PDF document text
    • http://www.it-ro.it/images/free-roblox-promo-codes-2021-not-expired.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/who-to-email-when-your-roblox-account-is-hacked.pdfIn PDF document text
    • http://onlinemusicsolutions.com.au/images/roblox-hack-site-free-robux-2021.pdfIn PDF document text
    • http://ralf-gryga.de/images/free-to-use-roblox-accounts.pdfIn PDF document text
    • http://hondenspecialist-engelien.nl/images/free-roblox-accounts-with-robux-2021.pdfIn PDF document text
    • http://horsa18.ru/images/get-free-robux-generator-parts-pokemon-silver.pdfIn PDF document text
    • http://www.thecoffeebaron.co.za/images/free-draw-2-alpha-roblox.pdfIn PDF document text
    • http://www.htc.edu.au/images/roblox-hacker-on-urbis.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/200-robux-free.pdfIn PDF document text
    • https://schulzpressetext.de/images/cheat-engine-keeps-getting-me-kicked-roblox.pdfIn PDF document text
    • http://huounaixunghe.com/images/one-piece-millenium-roblox-found-a-hacki-book.pdfIn PDF document text
    • http://www.torvet11.dk/images/money-hack-restaurant-tycoon-roblox.pdfIn PDF document text
    • http://solidkom.ch/images/sparereborn-roblox-hacks.pdfIn PDF document text
    • http://www.friendshiptransport.net/images/descargar-hack-de-jailbreak-roblox.pdfIn PDF document text
    • http://genialica.de/images/how-to-sell-items-for-robux-for-free-roblox.pdfIn PDF document text
    • https://bancroftandsons.com/images/blue-stacks-robux-hack.pdfIn PDF document text
    • https://www.poiskavia.ru/images/free-roblox-adopt-me-money.pdfIn PDF document text
    • http://androidthai.in.th/images/prison-royale-roblox-hack.pdfIn PDF document text
    • http://eddegrootassurantien.nl/images/free-robux-no-downloads-needed.pdfIn PDF document text
    • https://uofk.edu/images/codes-for-free-sp-in-ice-cream-simulator-roblox.pdfIn PDF document text
    • https://www.mrsz.ir/images/roblox-blue-aldias-tshirt-free.pdfIn PDF document text
    • http://instrumenttut.by/images/aimbot-fro-roblox-download-free.pdfIn PDF document text
    • http://www.occquimica.com.br/images/take-anyones-robux-robuxian-hack.pdfIn PDF document text
    • http://geometraperiotto.it/images/como-descargarse-hacks-en-roblox-jailbreak-agosto-2021.pdfIn PDF document text
    • http://behsanroshd.com/images/hacks-for-roblox-mining-simulator.pdfIn PDF document text
    • http://fratellimazzoleni.it/images/roblox-hcks.pdfIn PDF document text
    • http://omahahospitalityhalloffame.org/images/roblox-hack-999999-robux-ios.pdfIn PDF document text
    • http://lechia-sedziszow.pl/images/robux-hack-apk-2021.pdfIn PDF document text
    • http://www.learningbydoinglingue.com/images/code-get-free-robux-roblox.pdfIn PDF document text
    • http://gestibrok.com/images/games-on-roblox-that-give-free-robux.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/who-to-email-when-your-In PDF document text
    • http://ralf-gryga.de/images/free-In PDF document text
    • http://horsa18.ru/images/get-In PDF document text
    • http://huounaixunghe.com/images/one-piece-millenium-In PDF document text
    • https://uofk.edu/images/codes-for-free-sp-in-ice-cream-simulator-In PDF document text
    • http://geometraperiotto.it/images/como-descargarse-hacks-en-In PDF document text
    • http://fratellimazzoleni.it/images/roblox-In PDF document text
    • http://lechia-sedziszow.pl/images/robux-hack-apk-In PDF document text
    • http://gestibrok.com/images/games-on-roblox-that-give-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006c9b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6C9B 26676 bytes
SHA-256: 7af9b3becf3e84ded6e2b43846644285c1b4ea000fda6c8b1f83a723f2520193
font_01_sfnt_off0000a882.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA882 2832 bytes
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2
font_02_sfnt_off0000b233.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB233 18708 bytes
SHA-256: 923d54c1bed63a50d7894786b9d6024bdd6e6088171407ce1a5787e18be51118