PDF malware analysis — malicious · 3dcf6fef368efdb2

MALICIOUS

PDF

52.3 KB Created: 2021-04-07 00:28:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-24

MD5: 4f0c32ac2437cb720b9b4e7876b384ec SHA-1: 00331932eb1b0f0d131a3dd3245d4488c1de8fc8 SHA-256: 3dcf6fef368efdb2f645253a3a512da9591b1daf50c9ea392618961eb4d4d58e

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs, with a primary lure pointing to a 'roblox-game-hack' page. This suggests a social engineering tactic to trick users into visiting a potentially malicious website. The heuristic firings confirm the presence of external URIs and a game hack redirect lure, indicating a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.8852

Heuristics 4

PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://mohacad.com/images/17-free-knife-codes-on-roblox-murder-mystery.pdfIn PDF document text
- http://www.torvet11.dk/images/roblox-synapse-free-september-2021.pdfIn PDF document text
- http://haertetechnik-steinbach.de/images/free-hack-on-roblox-no-email-or-no-password.pdfIn PDF document text
- https://inspiration-modellbau.de/images/wie-kann-man-bei-roblox-geld-cheaten.pdfIn PDF document text
- http://poltekkeskhjogja.ac.id/images/roblox-free-draw-discord.pdfIn PDF document text
- http://ce-tsv-nantes.fr/images/money-hack-roblox-sunset-city.pdfIn PDF document text
- https://sitam.co.in/images/bloxy-site-free-robux.pdfIn PDF document text
- http://www.boic.nl/images/free-robux-100-legt.pdfIn PDF document text
- http://pisanie-nut.pl/images/bloxland-where-you-get-free-robux-codes.pdfIn PDF document text
- https://kalendarite.eu/images/free-unused-roblox-gift-cards.pdfIn PDF document text
- https://allpi.int/images/how-to-talk-to-roblox-if-you-get-hacked.pdfIn PDF document text
- http://sdservicesrl.it/images/roblox-vamprire-hunters-2-wall-hack-download.pdfIn PDF document text
- http://enosiderma.gr/images/how-to-hack-roblox-weight-lifting-simulator-3.pdfIn PDF document text
- http://brokermortgages.com/images/how-to-have-a-madcity-roblox-hack.pdfIn PDF document text
- http://www.pcclawyers.com.au/images/roblox-weight-lifting-sim-hack.pdfIn PDF document text
- http://www.fanciullovito.it/images/army-roblox-free-play.pdfIn PDF document text
- http://www.awakeningtruth.org/images/get-loads-of-free-robux.pdfIn PDF document text
- http://bullyinformate.org/images/how-to-tell-if-your-account-is-hacked-on-roblox.pdfIn PDF document text
- https://www.appartamenticroazia24.com/images/free-roblox-soldier-gfx-ww2.pdfIn PDF document text
- https://leckeres-geschenk.de/images/all-code-is-hacking-simulator-roblox.pdfIn PDF document text
- http://ns1.radiofacil.net/images/free-jailbreak-account-roblox.pdfIn PDF document text
- http://ns1.radiofacil.net/images/nuevo-hack-generador-de-robux-de-roblox-by-pignolise.pdfIn PDF document text
- https://www.hbproducts.dk/images/how-to-hack-roblox-group-ranks.pdfIn PDF document text
- https://esl.ipb.ac.id/images/cool-hacks-for-roblox.pdfIn PDF document text
- http://leigraphics.com/images/how-to-hack-roblox-defenders-of-robloxia.pdfIn PDF document text
- http://panaceafamilymedicine.com/images/heartless-roblox-hack-download.pdfIn PDF document text
- http://santeh-40.ru/images/free-codes-toy-for-roblox.pdfIn PDF document text
- https://www.brainpads.com/images/the-best-hacker-on-roblox.pdfIn PDF document text
- https://www.academiaanticorrupcion.org/images/acount-info-for-roblox-hack-with-robux.pdfIn PDF document text
- https://www.stkdb.cz/images/how-to-get-free-robux-on-fire-tablet.pdfIn PDF document text
- https://www.yewtreealpacas.co.uk/images/admin-roblox-hack-roblox.pdfIn PDF document text
- http://www.gadanie.lv/images/free-roblox-card-pin-code.pdfIn PDF document text
- http://bkd1.balikpapan.go.id/images/free-dell-laptop-roblox.pdfIn PDF document text
- http://www.sanjosedeminas.gob.ec/images/roblox-new-lighting-game-free.pdfIn PDF document text
- http://loszavera.com/images/funny-hack-scripts-roblox-pastebin.pdfIn PDF document text
- http://dottgagliardi.com/images/https-web-roblox-com-robux-free.pdfIn PDF document text
- https://www.cfdcnv.com/images/roblox-phantom-forces-uncopylocked-all-guns-free.pdfIn PDF document text
- http://prodajalec.si/images/robux-free-generator-2021.pdfIn PDF document text
- http://seniornetwanganui.org.nz/images/free-developer-product-ids-roblox.pdfIn PDF document text
- http://www.hawler.in/images/vuxvux-free-robux.pdfIn PDF document text
- http://www.marambio.com.ar/images/roblox-straight-awayu-cheats-for-money-on-roblox.pdfIn PDF document text
- https://www.udivadlahotel.cz/images/facebook-roblox-hack.pdfIn PDF document text
- http://www.gadanie.lv/images/how-to-change-your-username-for-free-in-roblox.pdfIn PDF document text
- http://www.eurologistiki.gr/images/how-do-you-get-free-roblox-coins.pdfIn PDF document text
- https://shimony.net/images/how-to-hack-someone-on-roblox-2021.pdfIn PDF document text
- http://www.nielsen2u.dk/images/roblox-card-generator-hack.pdfIn PDF document text
- http://rumler.pl/images/how-to-get-money-roblox-cheat.pdfIn PDF document text
- http://k2visual.com.br/images/how-to-get-free-robux-no-glitch.pdfIn PDF document text
- http://armatrutz.de/images/test-your-own-roblox-shirt-for-free.pdfIn PDF document text
+20 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006dff.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6DFF	26324 bytes
SHA-256: `12a9c8d289b94db550b045891f8bee239506da26454799b756f7f82f18f3a5e4`
`font_01_sfnt_off0000a9b3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA9B3	17972 bytes
SHA-256: `1266a7fd003f5d45b1dbf922ee6b6c0b29d8812f6d2079b936dd52b75deee201`

Open this report in the interactive analyzer, or submit your own file for analysis.