Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b4d3cc6d9d84eaa…

MALICIOUS

PDF

239.9 KB Created: 2021-04-05 02:02:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-22
MD5: e6c150d68eda46135b75bcc8e7eafd37 SHA-1: ca90907663d60cfa0a2954101ab398bc961c4b86 SHA-256: 2b4d3cc6d9d84eaad4e6f0687f50e45fbf8fb549dbc6bd99551c5fe14485e276
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is a PDF that uses a lure related to game hacks to trick users. It contains heuristics indicating it attempts to lure users into executing commands via a shell, and it embeds multiple URLs that likely lead to further malicious content or downloads. The ClamAV detection and ML classifier also strongly indicate maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5773

Heuristics 6

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/synapse-hack-roblox-for-android PDF link annotation
    • http://www.hawler.in/images/how-to-get-robux-free-no-human-verification.pdfIn PDF document text
    • http://energotestcontrol.ru/images/hacks-de-pago-para-roblox.pdfIn PDF document text
    • http://julo-it.net/images/hitbox-resizer-hack-roblox.pdfIn PDF document text
    • http://iricamidelcuore.it/images/can-you-hack-robux-in.pdfIn PDF document text
    • http://bilhetim.com.br/images/roblox-obby-play-for-free.pdfIn PDF document text
    • http://kontaktadig.se/images/lockview-hack-roblox.pdfIn PDF document text
    • https://bapalaye.org/images/free-shirts-roblox-that-i-can-copy.pdfIn PDF document text
    • http://zarinnameh.ir/images/how-to-hack-roblox-using-cmd.pdfIn PDF document text
    • http://batutynas.lt/images/robux-hack-no-verification-or-human-check.pdfIn PDF document text
    • https://cintasoeste.com.ar/images/free-robux-profile.pdfIn macro / runtime command snippet
    • https://www.ferienhausdirektkroatien.de/images/xonnek-hack-de-roblox.pdfIn macro / runtime command snippet
    • https://www.fenews.co.uk/images/roblox-cheat-ninja-legend.pdfIn PDF document text
    • http://serviio.org/images/what-is-bad-about-roblox-free-models.pdfIn PDF document text
    • https://uofk.edu/images/earn-robux-today-hack.pdfIn PDF document text
    • http://pourvosvacances.com/images/banning-hacks-for-khols-admin-house-roblox.pdfIn PDF document text
    • http://msfs-eastafrica.com/images/cool-roblox-outfits-for-fre.pdfIn PDF document text
    • http://www.fanciullovito.it/images/money-hack-roblox-2021-february.pdfIn PDF document text
    • https://seedungo.com/images/how-to-get-free-items-in-the-catalog-roblox.pdfIn PDF document text
    • http://msfs-eastafrica.com/images/press-one-button-to-get-free-robux.pdfIn PDF document text
    • http://ff-obertraun.at/images/hack-ed-roblox.pdfIn PDF document text
    • http://batutynas.lt/images/robux-hack-no-verificatioIn macro / runtime command snippet
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036954.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36954 21520 bytes
SHA-256: c944c408c44c9d21392e301b4e1b26ecfc3f516b1a3558e41b1f22e31cf8ae04
font_01_sfnt_off00039848.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39848 18720 bytes
SHA-256: 40945b2ecbccf80e997a0feaf0c21aab2963369ce7173476b6e4cfb0697e8934

Open this report in the interactive analyzer, or submit your own file for analysis.