Malicious PDF — malware analysis report

Static analysis result for SHA-256 2611f2a681a31eb4…

MALICIOUS

PDF

240.2 KB Created: 2021-04-04 22:58:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 1d7c24e21a8a02d5e4e62e90f40d9de9 SHA-1: 726ea016163232788eb3bb77ef9db0d703d4eab3 SHA-256: 2611f2a681a31eb434f79035e885827bb79e2054d646a07d99d79390cd442ccf
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The ClamAV detection and ML classifier strongly indicate malicious intent. The document body and embedded URLs suggest a lure related to Roblox, likely directing users to phishing or malware download sites. The presence of external URIs and the general nature of the content point towards a phishing or credential harvesting attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5773

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/when-is-rovive-on-roblox-gonna-be-free
    • http://steklofara.com.ua/images/hilton-hotel-roblox-hacks.pdf
    • http://santeh-40.ru/images/free-green-hat-roblox.pdf
    • https://socialvalue.gr/images/roblox-register-free.pdf
    • http://greasley.online/images/free-roblox-codes-for-robux-2021.pdf
    • https://blagvist.com.ua/images/emporor-roblox-hack.pdf
    • http://intrasservices.com/images/how-to-get-cheat-engine-roblox-elemental-wars.pdf
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/how-to-get-free-robux-no-password.pdf
    • http://kishplus.ir/images/cheat-codes-build-a-boat-roblox.pdf
    • https://www.colditex.com/images/roblox-redeem-card-codes-hack.pdf
    • http://alexandrion.com/images/roblox-fr-extreme-hack-net.pdf
    • http://www.pacoestrada.it/images/lazyblox-com-how-to-get-free-robux.pdf
    • https://masseymotorcars.com/images/2021-000000-free-robux.pdf
    • http://www.apocalissedigesucristo.com/images/how-to-use-cheat-engine-in-roblox-2021.pdf
    • http://finettifrs.it/images/free-robux-generator-com-oprewards.pdf
    • http://clubpure.org/images/roblox-hack-vehicle-simulator.pdf
    • https://gzog.pl/images/how-to-hack-a-roblox-server-2021.pdf
    • https://belixconstructions.com.au/images/free-robux-only-enter-username.pdf
    • http://www.oberberger.it/images/how-to-earn-free-robux-easy.pdf
    • https://www.dachytarasowe.eu/images/get-roblox-r-free-on-android.pdf
    • http://safwafurniture.com/images/free-roblox-supreme-pants.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036ae6.bin
93f467b4398b634297d6806d7942d2e987adbf7a0778a0aeccf450d48384456f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36AE6 21772 bytes
font_01_sfnt_off00039a98.bin
9daaff4a086dd6575b78d55f70dc281f4506696327f58d5e3ef1b1342d165e9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x39A98 18360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.