PDF malware analysis — malicious · 520f671483c7de27

MALICIOUS

PDF

242.8 KB Created: 2021-04-04 17:09:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24

MD5: aa29c79b8873abf5326471c1f7b1c1e2 SHA-1: c761160897c3c83454f6447c66e4faa17a9c0b43 SHA-256: 520f671483c7de27fb125208fe538f1f917e47057ba4275ff77e4c40d4f50068

72 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document that contains a lure for free Robux codes, a common phishing tactic. The ClamAV detection explicitly identifies it as Pdf.Phishing.Roblox062100-9873116-0. An external URI pointing to a 'free-robux-codes-2021' page was found, suggesting the document is part of a phishing campaign.

Machine Learning

Nyx PDF Classifier suspicious score 0.2693

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/free-robux-codes-2021 PDF link annotation
- http://unionmusicaldebenidorm.com/images/free-roblox-code-generator-no-human-verification.pdfIn PDF document text
- http://egorplitka.ru/images/roblox-hack-players.pdfIn PDF document text
- http://www.bripi.pl/images/free-robux-no-generator-no-survey.pdfIn PDF document text
- https://schaefer-rechtsanwaelte.com/images/hackear-roblox-sin-inspeccionar.pdfIn PDF document text
- http://vagency.us/images/best-free-roblox-skin.pdfIn PDF document text
- http://www.les2alpes-location.com/images/free-roblox-guest.pdfIn PDF document text
- http://jugendfeuerwehr-scheinfeld.de/images/instant-hack-robux.pdfIn PDF document text
- https://inspiration-modellbau.de/images/hack-app-robux.pdfIn PDF document text
- https://www.osoc.com/images/free-adidas-asset-roblox.pdfIn PDF document text
- http://eltisstudio.sk/images/how-to-get-free-robux-no-builders-club-2021.pdfIn PDF document text
- http://www.actae.gr/images/appbounty-robux-hack-without-human-verification.pdfIn PDF document text
- http://britishcomics.com/images/hack-web-tool-roblox-descargar-gratis.pdfIn PDF document text
- http://papec.ir/images/hacked-jeans-roblox.pdfIn PDF document text
- http://farwesterndistrict.org/images/how-to-get-free-robux-no-download-or-survey-2021.pdfIn PDF document text
- https://meltonschool.org/images/keisyo-free-robux.pdfIn PDF document text
- http://serviio.org/images/free-4-mobile-24-roblox.pdfIn PDF document text
- http://atelierweb.it/images/seiten-zum-robux-hacken.pdfIn PDF document text
- http://www.art-concept.gr/images/banning-hack-roblox-working-2021.pdfIn PDF document text
- https://consorziocsa-asicaivano.it/images/roblox-pc-cheats.pdfIn PDF document text
- https://www.wadowice24.pl/images/allahuakbar-roblox-hack.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00037089.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x37089	23272 bytes
SHA-256: `5b88a6c0c4993a2002092a57604409ca5e079102b818259da3efb97899b252b2`
`font_01_sfnt_off0003a540.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3A540	18012 bytes
SHA-256: `7d573ada0d548864d07eb289c10aa095cb3198a9a25c61ad4bb34178648b7f02`

Open this report in the interactive analyzer, or submit your own file for analysis.