PDF malware analysis — malicious · 44e2987d40318bee

MALICIOUS

PDF

245.3 KB Created: 2021-04-05 08:05:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-13

MD5: 5c261cbb6f5808078e3df2a95a0d4161 SHA-1: 800d09ccf3e83aa568f537b47add65f135d7c260 SHA-256: 44e2987d40318beedde83debf0e6dddaac50044ef00c66147e71cd6be4c1cb89

72 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as malicious by ClamAV with a specific phishing signature related to Roblox. It contains multiple embedded URLs that lead to pages offering free items or cheats for Roblox, acting as a lure. The heuristic for a download button further supports the phishing and potential malware distribution intent.

Machine Learning

Nyx PDF Classifier suspicious score 0.2693

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/free-roblox-beach-gfx PDF link annotation
- http://mypizzaoven.com/images/free-models-roblox.pdfIn PDF document text
- http://fiur-malermeister.de/images/roblox-goku-shirt-free.pdfIn PDF document text
- http://schlossschaenke-andernach.de/images/case-clicker-case-hack-roblox.pdfIn PDF document text
- https://www.arquetopia.org/images/free-items-on-roblox-pastebin.pdfIn PDF document text
- http://mainzer-marktplatz.de/images/how-to-get-anything-in-the-roblox-catalog-for-free.pdfIn PDF document text
- http://www.nielsen2u.dk/images/free-dominus-roblox-code.pdfIn PDF document text
- https://corbo.ru/images/roblox-free-robux-test-site.pdfIn PDF document text
- https://reggieslockandkey.com/images/roblox-free-maps.pdfIn PDF document text
- https://pa-pangkalpinang.go.id/images/free-robux-generator-no-quiz.pdfIn PDF document text
- https://masseymotorcars.com/images/hackers-that-hack-robux.pdfIn PDF document text
- http://tegeler-segler.de/images/how-to-change-name-for-free-roblox.pdfIn PDF document text
- https://socialvalue.gr/images/how-to-get-free-braces-on-roblox.pdfIn PDF document text
- http://sdservicesrl.it/images/free-ride-roblox.pdfIn PDF document text
- http://forsan.edu.eg/images/rbx-gg-free-robux-generator.pdfIn PDF document text
- http://lamascheradiferro.dk/images/injector-hack-robux.pdfIn PDF document text
- http://bkd1.balikpapan.go.id/images/escape-school-obby-roblox-cheats.pdfIn PDF document text
- http://lawnn.ru/images/roblox-blox-no-hero-academia-script-hack.pdfIn PDF document text
- http://loriginedupain.org/images/how-to-create-a-roblox-group-for-free.pdfIn PDF document text
- https://gigbagwinkel.nl/images/how-to-change-my-roblox-name-for-free.pdfIn PDF document text
- http://iedarelief.us/images/free-goku-ui-omen-roblox.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0003799e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3799E	23936 bytes
SHA-256: `af5f262f34ee415a1d6c9e3315fd73b85a6a23b789761d6c3dd3538780ebbd65`
`font_01_sfnt_off0003b000.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3B000	17876 bytes
SHA-256: `cc3de3ce1decb9ed4a0044f03cc53f9d746b30599ea7d1bc0af74037bee95cd5`

Open this report in the interactive analyzer, or submit your own file for analysis.