PDF malware analysis — malicious · 2a431c2e555a2b7a

MALICIOUS

PDF

61.0 KB Created: 2021-04-05 21:48:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-16

MD5: f654d967dc0d41387d5c8969e2706ba2 SHA-1: 847589ad221fc0bcefd62223232e5883635c8d39 SHA-256: 2a431c2e555a2b7adf7fd8d8d7e383ce355db28195713e94a57c20713475fbd8

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a heuristic firing for a clipboard command lure, indicating it attempts to trick the user into executing commands. The document body, though partially obfuscated, suggests a lure related to 'Roblox Jailbreak cheats', and the presence of numerous related URLs reinforces this theme. The primary attack pattern involves social engineering to bypass user execution controls.

Machine Learning

Nyx PDF Classifier malicious score 0.6193

Heuristics 4

Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/cheat-tembus-roblox-jailbreak-2021 PDF link annotation
- http://greenoase.be/images/roblox-free-antlers.pdfIn PDF document text
- https://www.stayon.no/images/roblox-robux-hack-no-survey-2021.pdfIn PDF document text
- http://bressanassessoria.com.br/images/free-robux-hack-no-inspect.pdfIn PDF document text
- https://gomsa.nl/images/roblox-roblox-hack-generator.pdfIn PDF document text
- http://poltekkeskhjogja.ac.id/images/hack-nuevo-para-roblox-2021-editar-servidor.pdfIn PDF document text
- http://sandra-masemann.de/images/roblox-free-everything.pdfIn PDF document text
- http://global-tech-security.be/images/how-to-get-free-robux-not-a-scam.pdfIn PDF document text
- http://www.boic.nl/images/can-i-download-roblox-for-free-right-now.pdfIn PDF document text
- http://iacovoulaw.com/images/free-20210-robux.pdfIn PDF document text
- https://www.najeebqasmi.com/images/free-owner-admin-roblox.pdfIn PDF document text
- http://www.lovecraftiana.com.ar/images/how-to-get-free-robux-in-roblox-2021-on-windows.pdfIn PDF document text
- http://safari-crimea.com/images/roblox-aimbot-hack-download.pdfIn PDF document text
- http://autenticohostalsalou.com/images/synapse-hacks-roblox.pdfIn PDF document text
- http://bkd1.balikpapan.go.id/images/roblox-cheat-enjen.pdfIn PDF document text
- https://arcasict.nl/images/roblox-guess-the-song-cheats.pdfIn PDF document text
- http://ordineingsa.it/images/roblox-gfx-maker-free.pdfIn PDF document text
- https://www.porthos.it/images/free-robux-generaters.pdfIn PDF document text
- http://biljartenbarendrecht.nl/images/cheat-engine-closes-roblox.pdfIn PDF document text
- https://wandpiraten.de/images/how-to-hack-a-roblox-account-easy-2021.pdfIn PDF document text
- https://jdlgroup.ca/images/robux-free-c.pdfIn PDF document text
- https://kimolos-link.gr/images/free-robux-2021.pdfIn PDF document text
- http://bwharrisalumniusa.org/images/beyblad-rebirth-roblox-hack.pdfIn PDF document text
- http://www.homesweethome.pl/images/roblox-inspect-element-free-robux-pastebin.pdfIn PDF document text
- http://clubpure.org/images/free-robux-no-verify-no-download.pdfIn PDF document text
- http://www.malonmalon.com.ar/images/roblox-free-draw-script.pdfIn PDF document text
- http://mydevice.com.au/images/free-roblox.pdfIn PDF document text
- http://legs11.co.za/images/booga-booga-roblox-cheats.pdfIn PDF document text
- http://osteonad.com/images/4-million-robux-free.pdfIn PDF document text
- http://seminolechapter.com/images/free-robux-hack-generator-club-no-survey.pdfIn PDF document text
- http://businessmart.ro/images/admin-roblox-hack-pastebin.pdfIn PDF document text
- http://aimp-market.ru/images/robux-hack-pastebin-youtube.pdfIn PDF document text
- https://www.hbproducts.dk/images/roblox-mad-city-hacks-2021.pdfIn PDF document text
- http://jugendfeuerwehr-scheinfeld.de/images/free-robux-givway.pdfIn PDF document text
- http://joshherman.com/images/free-robux-using-codes.pdfIn PDF document text
- https://www.manisoft.ir/images/free-maps-wwii-realistic-roblox.pdfIn PDF document text
- http://learningarabic.co.uk/images/how-to-get-a-free-roblox-group.pdfIn PDF document text
- https://www.audev.com/images/how-to-use-cheats-on-roblox-deathrun.pdfIn PDF document text
- http://atelierweb.it/images/how-to-hack-any-pokemon-into-project-pokemoin-roblox.pdfIn PDF document text
- http://androidthai.in.th/images/roblox-gamepass-free.pdfIn PDF document text
- http://seminolechapter.com/images/download-portable-hacks-roblox.pdfIn PDF document text
- http://nosocomium.rv.ua/images/roblox-robux-hack-2021-no-human-verification.pdfIn PDF document text
- http://babbibooth.com/images/free-earned-roblox.pdfIn PDF document text
- https://itv-grabungen.de/images/hack-roblox-crazzywhatever091.pdfIn PDF document text
- https://www.ncscolour.no/images/roblox-cheat-engine-fly-hack.pdfIn PDF document text
- http://lesvossolidarity.org/images/roblox-accounts-free-2021.pdfIn PDF document text
- http://g3galileo.com/images/how-to-download-roblox-on-computer-hack-tool.pdfIn PDF document text
- http://cmfd.nl/images/how-to-fly-hack-on-roblox-2021.pdfIn PDF document text
- http://homequeen.de/images/roblox-prison-life-before-it-was-hacked.pdfIn PDF document text
- http://homequeen.de/images/cruise-ship-tycoon-roblox-money-cheat.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000082ea.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x82EA	27052 bytes
SHA-256: `691161a58bc03485b877603549bc88c75fc24862a7025817bf660d87eb567cba`
`font_01_sfnt_off0000bf05.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBF05	2832 bytes
SHA-256: `77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2`
`font_02_sfnt_off0000c8b5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC8B5	18964 bytes
SHA-256: `b7faf8b2c0359aaa5653fcc80129d23939d809ddd23225f5699e7e4e70f861cf`

Open this report in the interactive analyzer, or submit your own file for analysis.