PDF malware analysis — malicious · 4c769b561572e2b0

MALICIOUS

PDF

60.1 KB Created: 2021-04-06 11:48:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-01

MD5: 26ccb25ad08b476400faaebc23e9250c SHA-1: 804e8fa64e1e9d8867474ce0602e057c5bde8899 SHA-256: 4c769b561572e2b08e75d13034c36910d7bef15badc8de6c498533cfa4ced2a3

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.6193

Heuristics 4

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://www.anies.eu/images/free-robux-codes-redeem-2021.pdfIn PDF document text
- http://musical-arts.de/images/roblox-chat-hacks-grab-knife.pdfIn PDF document text
- http://nevesomost.by/images/free-robux-card-codes-live.pdfIn PDF document text
- http://eliteprofkosmetik.com.ua/images/hack-vampire-hunters-2-roblox.pdfIn PDF document text
- https://www.coriglianocalabro.it/images/prisonj-life-hacks-roblox.pdfIn PDF document text
- https://www.tsdb.com.au/images/rmc-free-roblox-aimbot-download.pdfIn PDF document text
- https://www.coriglianocalabro.it/images/rxfast-ml-free-robux.pdfIn PDF document text
- https://arcasict.nl/images/free-robux-watch-add-to-get-robux.pdfIn PDF document text
- https://pompesfunebresleveque.fr/images/how-do-u-get-free-robux-for-roblox.pdfIn PDF document text
- http://racunari.in.rs/images/free-robux-giftcard-generator.pdfIn PDF document text
- http://rivas-treuhand.ch/images/roblox-apk-free-download-pc.pdfIn PDF document text
- https://www.ausecus.com/images/free-redvalk-code-roblox-news.pdfIn PDF document text
- http://fairwaygolftravel.co.uk/images/how-do-you-get-free-robux-google.pdfIn PDF document text
- https://photographygroupofbunbury.com/images/roblox-pc-hack-robux.pdfIn PDF document text
- https://roberto-gac.com/images/free-verify-email-roblox.pdfIn PDF document text
- http://cleanteclogistics.com/images/free-roblox-books.pdfIn PDF document text
- http://panaceafamilymedicine.com/images/free-robux-promo-codes-2021.pdfIn PDF document text
- https://www.audipec.com.br/images/how-to-download-roblox-on-computer-hack.pdfIn PDF document text
- http://www.peterdejonge.nl/images/roblox-hack-script-2021.pdfIn PDF document text
- https://www.albisser.ch/images/roblox-cheat-free-download.pdfIn PDF document text
- https://eurekaaccounting.co.za/images/20-roblox-card-free.pdfIn PDF document text
- https://www.knxuk.org/images/free-robux-ge.pdfIn PDF document text
- http://korporacjaroma.pl/images/roblox-free-download-no-sign-up.pdfIn PDF document text
- https://gomsa.nl/images/robux-website-no-hack.pdfIn PDF document text
- http://aimp-market.ru/images/execute-scripts-notmallyso-sorunu-roblox-hack.pdfIn PDF document text
- https://farkas.de/images/jd-roblox-free-knife-code.pdfIn PDF document text
- https://www.ergolight.at/images/free-roblox-account-generatorold-account.pdfIn PDF document text
- http://sb2m.com.br/images/cheat-list-roblox.pdfIn PDF document text
- https://lesegais.ru/images/infinite-jump-roblox-jump-hack.pdfIn PDF document text
- http://www.eurosan1.ba/images/roblox-studio-download-free-for-ipad.pdfIn PDF document text
- https://masseymotorcars.com/images/how-to-change-your-roblox-name-for-free-2021.pdfIn PDF document text
- http://www.occquimica.com.br/images/free-generator-code-roblox.pdfIn PDF document text
- http://columbuscigar.com/images/free-robux-obby-download.pdfIn PDF document text
- https://www.tsdb.com.au/images/free-jordans-on-roblox.pdfIn PDF document text
- http://www.evaplast.by/images/how-to-get-free-chothes-on-roblox-2021.pdfIn PDF document text
- http://avocatultau.eu/images/ways-to-get-free-robux-easy.pdfIn PDF document text
- http://hondenspecialist-engelien.nl/images/free-roblox-accounts-with-robux-2021-november.pdfIn PDF document text
- http://almacargo.com/images/one-app-rewards-robux-hack.pdfIn PDF document text
- http://altc.de/images/free-roblox-toy-codes-vermillion.pdfIn PDF document text
- http://gaeconsultores.cl/images/how-to-hack-roblox-using-cheat-engine-65.pdfIn PDF document text
- http://jasperfirstumc.com/images/how-to-hack-a-roblox-account-easy-2021.pdfIn PDF document text
- https://almaville.org.kz/images/roblox-ps3-free-download.pdfIn PDF document text
- http://brandyourbody.com/images/roblox-free-download-for-tablet.pdfIn PDF document text
- http://santeh-40.ru/images/hacks-para-tener-robux-gratis.pdfIn PDF document text
- https://www.elevage-chiot.fr/images/is-roblox-free-on-laptop.pdfIn PDF document text
- http://promotion.si/images/hack-coins-pizzeria-roleplay-remastered-roblox-cheat-engine.pdfIn PDF document text
- http://hemmet-strand.dk/images/how-to-get-anything-free-in-roblox.pdfIn PDF document text
- https://lesegais.ru/images/how-to-get-free-bc-in-roblox-patebin.pdfIn PDF document text
- http://the-specials.ch/images/arsenal-hacks-roblox-2021.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007045.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7045	27380 bytes
SHA-256: `4fe9393d7ffe554cc3ce356ba51b4b4f2a4cdfb26ea28fbb03dc98be6c11e64e`
`font_01_sfnt_off0000ab5a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAB5A	11440 bytes
SHA-256: `154d59d1680f2d1e38ccb783d6997f344290d121007e51df331726de4128c12e`
`font_02_sfnt_off0000c67b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC67B	18456 bytes
SHA-256: `a3ebe1ff8b51697398cafe9f9291fd994c0fa358a377e0c049cf12b2481bda75`

Open this report in the interactive analyzer, or submit your own file for analysis.