PDF malware analysis — malicious · 25e2d1f2f34f76f8

MALICIOUS

PDF

240.0 KB Created: 2021-04-04 17:34:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-18

MD5: ec5e7382cda7ea8474af23305a93cb32 SHA-1: c5f3a81a9692568438fac7b7f46b3b90f60fa8f9 SHA-256: 25e2d1f2f34f76f85bd1863eaf494fb47a94860f4ffa8dc65e11d6d61a541616

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.5773

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/free-roblox-account-cookie-codes PDF link annotation
- http://vagency.us/images/ssuper-speed-hack-in-roblox-2021.pdfIn PDF document text
- http://genialica.de/images/free-jailbreak-hack-roblox.pdfIn PDF document text
- http://agrupamentoescolas-alfredo-da-silva.com/images/dansploit-hack-roblox.pdfIn PDF document text
- http://gestibrok.com/images/roblox-fight-the-monsters-cheats.pdfIn PDF document text
- https://www.yewtreealpacas.co.uk/images/fly-hack-jailbreak-roblox.pdfIn PDF document text
- http://artindex.pro/images/cheat-monnaie-roblox.pdfIn PDF document text
- http://www.hotelcimone.it/images/how-to-hack-someones-robux-in-roblox.pdfIn PDF document text
- http://cadcam.no/images/assassin-cheats-roblox.pdfIn PDF document text
- https://semanasantacehegin.com/images/cerberus-download-free-roblox.pdfIn PDF document text
- http://www.eurologistiki.gr/images/roblox-hacks-scythe-script.pdfIn PDF document text
- https://www.lavigny.ch/images/kakashi-roblox-roblox-t-schirts-free.pdfIn PDF document text
- http://vipservice-bg.com/images/free-stuff-2021-roblox.pdfIn PDF document text
- https://www.ghknights.org/images/free-robux-no-survey-or-human-verification-or-download.pdfIn PDF document text
- http://musical-arts.de/images/como-usar-cheat-engine-no-roblox-2021.pdfIn PDF document text
- http://www.evaplast.by/images/free-unlimited-robux-and-tix.pdfIn PDF document text
- http://joshherman.com/images/free-100-robux-gift-card-codes-2021-no-human-verification.pdfIn PDF document text
- http://fradiomas.com/images/free-robux-giver-no-survey.pdfIn PDF document text
- http://egorplitka.ru/images/roblox-card-number-free.pdfIn PDF document text
- https://www.academiaanticorrupcion.org/images/www-bandicam-com-roblox-hack.pdfIn PDF document text
- https://www.sauvonsleclimat.org/images/retail-tycoon-roblox-money-cheat.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00036a2f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x36A2F	21600 bytes
SHA-256: `e61298540f2caf48a486d10d9feb72786891d5e5cff16cb0ceb66a5f6c042505`
`font_01_sfnt_off000399be.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x399BE	18384 bytes
SHA-256: `af77bd84bf87dfa85819da63bc34c5d1718ee00132c6799b23a1ab0952176098`

Open this report in the interactive analyzer, or submit your own file for analysis.