Malicious PDF — malware analysis report

Static analysis result for SHA-256 2aa4c9fa20c81e2e…

MALICIOUS

PDF

56.5 KB Created: 2021-04-06 15:23:27 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 1f956f5f90f617078e6d057490d7febf SHA-1: 4fc3736f002f4f0729984db8859e227845cce49e SHA-256: 2aa4c9fa20c81e2ebc0da227d8b92a088bf3750e8be2fcd4c3e4d0d1265c1d8c
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6397

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://asiashop-france.fr/images/synapse-roblox-hack-buy.pdfIn PDF document text
    • http://halitbayramoglu.com.tr/images/roblox-hack-menu-download.pdfIn PDF document text
    • https://www.abrapppe.org.br/images/free-cute-royale-high-outfits-roblox.pdfIn PDF document text
    • http://www.art-concept.gr/images/how-to-get-the-diamond-block-in-roblox-for-free.pdfIn PDF document text
    • http://www.kendo.gr/images/ghow-to-get-free-robux-on-computer.pdfIn PDF document text
    • http://elzet-opakowania.pl/images/roblox-free-swords.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/how-to-hack-in-roblox-2021-mac.pdfIn PDF document text
    • http://ivalor.fr/images/roblox-free-hoverboard.pdfIn PDF document text
    • http://www.isril.it/images/proto-hack-for-roblox.pdfIn PDF document text
    • https://www.air-shop.cz/images/shinobi-life-roblox-hack-onyx.pdfIn PDF document text
    • http://chocolats-boccardi-carcassonne.com/images/roblox-obby-gives-you-robux-for-free-no-password-required.pdfIn PDF document text
    • https://www.dressel-immobilien-mv.de/images/free-robux-without-download-pc.pdfIn PDF document text
    • http://evp-sanorlenok.ru/images/legit-free-robux-sites.pdfIn PDF document text
    • http://www.drent.se/images/how-to-get-free-robux-proof.pdfIn PDF document text
    • http://www.zdravazena.sk/images/best-free-fortnite-roblox-game.pdfIn PDF document text
    • http://maslabaou.com/images/free-female-faces-roblox.pdfIn PDF document text
    • http://jaeger-bauplanung.de/images/web-cheats-xyz-roblox.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/cheated-roblox-gun.pdfIn PDF document text
    • https://jdlgroup.ca/images/robux-hack-apps.pdfIn PDF document text
    • http://iluvlocalplaces.com/images/free-robuxcom-no-survey.pdfIn PDF document text
    • http://somvisio.es/images/hiw-to-get-free-robux-on-roblox-2021-fast.pdfIn PDF document text
    • http://learningarabic.co.uk/images/hacks-para-roblox-murder-mystery-2-xp.pdfIn PDF document text
    • http://www.mosaikshop.at/images/anarchy-roblox-hack.pdfIn PDF document text
    • https://gomsa.nl/images/free-printable-roblox.pdfIn PDF document text
    • http://texnes-plus.gr/images/how-to-get-bc-on-roblox-for-free-2021.pdfIn PDF document text
    • https://studiodegaetano.it/images/get-free-robux-today.pdfIn PDF document text
    • http://somvisio.es/images/free-roblox-exploit-lua-script-executor-free-no-virus.pdfIn PDF document text
    • http://www.likto.eu/images/how-to-get-free-private-server-roblox.pdfIn PDF document text
    • http://instrutech.co.th/images/roblox-cheat-code-generator.pdfIn PDF document text
    • http://www.zdravazena.sk/images/descargar-natevangisapotato-stella-hacked-roblox.pdfIn PDF document text
    • https://www.fhccu.com/images/free-robux-no-human-verify-or-survey.pdfIn PDF document text
    • http://massimocarpegna.com/images/how-do-you-get-robux-for-free-on-roblox-2021.pdfIn PDF document text
    • http://76remont-kvartir.ru/images/how-to-hack-roblox-for-robux-and-tix.pdfIn PDF document text
    • http://petarda.hu/images/ex7-roblox-hacks.pdfIn PDF document text
    • http://safwafurniture.com/images/hack-tener-muchos-diamantes-en-royale-high-roblox.pdfIn PDF document text
    • http://jakthund.org/images/robux-now-for-free.pdfIn PDF document text
    • http://cosver.eu/images/easy-jeje-free-robux.pdfIn PDF document text
    • http://greenoase.be/images/how-to-get-a-hacked-account-back-on-roblox-2021.pdfIn PDF document text
    • http://www.marambio.com.ar/images/roblox-singing-hack.pdfIn PDF document text
    • http://www.teapotjewelry.com/images/roblox-games-getting-hacked.pdfIn PDF document text
    • http://www.actae.gr/images/roblox-fly-hack-no-download.pdfIn PDF document text
    • http://www.ntc.edu.za/images/uirbxclub-free-robux-hacker-p.pdfIn PDF document text
    • http://icomsolutions.com.au/images/roblox-free-admin-exploit.pdfIn PDF document text
    • http://per-bittner.de/images/hack-retail-tycoon-roblox.pdfIn PDF document text
    • http://unilin21.ru/images/rbxoffers-com-earn-free-robux.pdfIn PDF document text
    • http://5346000.com/images/how-to-hack-easy-robux-today.pdfIn PDF document text
    • http://www.isril.it/images/free-robux-python-code-2021.pdfIn PDF document text
    • http://zarinnameh.ir/images/how-to-get-free-outrageous-builders-club-on-roblox-2021.pdfIn PDF document text
    • http://www.jureclomas.com.ar/images/roblox-apocalypse-rising-hack-2021.pdfIn PDF document text
    +16 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006ee4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EE4 26200 bytes
SHA-256: d80a55dfd14355728049712ffc092eea0e348461b079607f3858013687108408
font_01_sfnt_off0000a9d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA9D3 3884 bytes
SHA-256: 40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf
font_02_sfnt_off0000b67a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB67A 19080 bytes
SHA-256: 08f4fb221fc8e8a0ede1ff90e662f7a6532421a114504219d6d0296145b9b0e4

Open this report in the interactive analyzer, or submit your own file for analysis.