Malicious PDF — malware analysis report

Static analysis result for SHA-256 3936da33c49160c6…

MALICIOUS

PDF

53.7 KB Created: 2021-04-06 11:47:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 00ca9bd436efc6754e66cae2cf3719c0 SHA-1: 1b17d08626edf02f27cc7acaeb3222bb9c8e1acb SHA-256: 3936da33c49160c65ebe3034fc6a0dc53c66ca3ecad80ba0d323ff5935ca87d6
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous links and a prominent call-to-action related to 'free Robux' and game hacks, directly aligning with a phishing or scam lure. The heuristic 'PDF_GAME_HACK_REDIRECT_LURE' confirms this intent. While no scripts were explicitly extracted, the nature of the embedded URLs suggests a potential for JavaScript execution or redirection to malicious sites designed to exploit user interest in game cheats.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8413

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://lakomat.by/images/how-to-hack-peoples-in-roblox.pdfIn PDF document text
    • http://aiyta.com/images/roblox-cheat-engine-speed-hack-2021.pdfIn PDF document text
    • https://laconce.com/images/roblox-free-robux-code-2021.pdfIn PDF document text
    • http://unc-europe.com/images/roblox-top-model-cheats.pdfIn PDF document text
    • http://citycare.pt/images/robux-hack-page.pdfIn PDF document text
    • http://leveillehic.com/images/chat-uncensor-hack-roblox.pdfIn PDF document text
    • http://www.backlineservice.nl/images/hacking-forums-roblox.pdfIn PDF document text
    • http://fiur-malermeister.de/images/free-hair-roblox-not-model-or-decal.pdfIn PDF document text
    • http://unc-europe.com/images/roblox-free-ship-code.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/killa-in-kalahari-sirius-mashup-copyright-free-roblox.pdfIn PDF document text
    • https://plumbingmedics.com/images/hw-to-gget-free-robux.pdfIn PDF document text
    • http://arcnjournals.org/images/cheat-engine-bypass-roblox-2021.pdfIn PDF document text
    • http://webstan.be/images/roblox-color-name-hack.pdfIn PDF document text
    • https://www.iadh.bi/images/free-draw-roblox-discord.pdfIn PDF document text
    • https://www.nema.go.ke/images/muscle-simulator-roblox-cheat-codes.pdfIn PDF document text
    • https://www.osoc.com/images/javascript-hack-robux.pdfIn PDF document text
    • http://kishplus.ir/images/free-robux-jenerador.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/roblox-granny-hack.pdfIn PDF document text
    • http://escolaarboc.cat/images/dinosaur-simulator-roblox-hack.pdfIn PDF document text
    • http://pgk-polaniec.pl/images/robux-hack-generator-2021.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/working-free-robux-server.pdfIn PDF document text
    • http://firesafetyservices.biz/images/free-obfuscator-roblox.pdfIn PDF document text
    • http://nalmpantistractors.gr/images/how-to-get-free-robux-no-hack-2021-on-ipad.pdfIn PDF document text
    • http://wcasrock.org/images/roblox-exploits-for-mac-free.pdfIn PDF document text
    • http://artcustomdrums.com/images/roblox-jailbreak-jump-hack.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/roblox-new-free-shirt-template.pdfIn PDF document text
    • http://regioliga.pl/images/xeno-hack-roblox.pdfIn PDF document text
    • http://bwharrisalumniusa.org/images/roblox-how-to-get-non-free-models.pdfIn PDF document text
    • http://baah.ca/images/roblox-free-model-viruses.pdfIn PDF document text
    • http://elllanorestaurants.com/images/how-to-hack-roblox-2021-march.pdfIn PDF document text
    • http://www.isril.it/images/roblox-cheat-engine-bypass-2021-super-power-training.pdfIn PDF document text
    • http://www.maakherumusic.net/images/cheat-codes-vhicule-simulator-roblox.pdfIn PDF document text
    • http://safwafurniture.com/images/free-roblox-accounts-v3rm.pdfIn PDF document text
    • http://alexanderautos.co/images/comment-faire-cheater-sur-roblox.pdfIn PDF document text
    • http://eltisstudio.sk/images/how-to-get-roblox-mod-menu-free.pdfIn PDF document text
    • http://electricpasion.com/images/wanted-money-hack-roblox.pdfIn PDF document text
    • https://kierowcyhgv.uk/images/roblox-kostenlos-robux-hacken-ohne-eine-app-zu-downloaden.pdfIn PDF document text
    • https://www.osoc.com/images/easy-robux-for-free.pdfIn PDF document text
    • https://www.saisystem.it/images/roblox-make-a-cake-hack.pdfIn PDF document text
    • http://www.campiresine.it/images/hacking-prestonplayz-roblox-account.pdfIn PDF document text
    • http://3dmedicus.ru/images/hack-generator-robux.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/free-robux-on-the-game.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/www-roblox-hack-top.pdfIn PDF document text
    • https://www.albisser.ch/images/free-way-to-get-p-in-plaza-game-on-roblox.pdfIn PDF document text
    • http://www.hawler.in/images/free-robux-by-completing-offers.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/how-to-get-a-free-skin-in-strucid-roblox.pdfIn PDF document text
    • http://www.inservis.cl/images/how-to-hack-into-a-friends-roblox-account.pdfIn PDF document text
    • https://www.abrapppe.org.br/images/r67-roblox-hack.pdfIn PDF document text
    • https://www.olboys.it/images/how-to-get-free-20210-robux-easy-and-fast.pdfIn PDF document text
    +11 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006be8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BE8 29812 bytes
SHA-256: b09ce7a2c94dcf0ce4b5ed4fafdf2bae83c5d96c388f9346a8aea1d207418ea2
font_01_sfnt_off0000ad16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAD16 18584 bytes
SHA-256: e073d14bb5071452fe4cefe7100857c0de41ec6e497e169ab3a404cd4884bf8f

Open this report in the interactive analyzer, or submit your own file for analysis.