Malicious PDF — malware analysis report

Static analysis result for SHA-256 54092777d2ca7b43…

MALICIOUS

PDF

248.3 KB Created: 2021-04-04 23:03:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: f6bb8b087cbed330ea57cd64f792a11b SHA-1: 1fc4c448e00c7556ba212adf712a2d6ad8418fdf SHA-256: 54092777d2ca7b43d2725cf218fab3952942e262f9771fe1356d9ad3d3617892
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a phishing signature related to Roblox. The document body and embedded URLs suggest a lure for users interested in hacking Roblox accounts, directing them to potentially malicious websites. While no scripts were explicitly extracted, the PDF format can embed JavaScript, and the presence of external URIs indicates a likely attempt to redirect the user to a compromised or malicious site.

Machine Learning

  • Nyx PDF Classifier clean score 0.1052

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-do-i-hack-into-someones-roblox-account
    • http://osteonad.com/images/how-to-get-free-robux-legally.pdf
    • https://septik-montag.ru/images/how-to-hack-in-roblox-prison-life.pdf
    • https://www.milewood.co.uk/images/how-to-get-free-stuff-in-roblox-without-robux.pdf
    • http://beagles-of-harmony.de/images/roblox-download-free-chromebook.pdf
    • http://nevesomost.by/images/el-mejore-hack-de-roblox-marzo.pdf
    • http://www.eurologistiki.gr/images/how-to-hack-a-roblox-game-2021.pdf
    • http://seytarehco.com/images/easy-robux-hack-no-human-verification.pdf
    • https://www.manisoft.ir/images/roblox-extreme-hack-net.pdf
    • https://www.acoustiguard.com/images/free-auto-clicker-for-roblox-ipad.pdf
    • https://ghpa.ru/images/robux-hack-inspect-element.pdf
    • http://aviaprofsoyuz.info/images/free-gsg9-roblox-group.pdf
    • http://iluvlocalplaces.com/images/easy-robux-hack-no-human-verification.pdf
    • http://britishcomics.com/images/harked-hack-roblox.pdf
    • http://manfeld.dk/images/roblox-how-to-get-obc-for-free.pdf
    • https://www.seeingindependence.org/images/free-robux-without-paying.pdf
    • https://gigbagwinkel.nl/images/free-roblox-hack.pdf
    • https://www.najeebqasmi.com/images/free-gucci-jacket-roblox.pdf
    • https://www.utalii.ac.ke/images/nonsense-diamond-roblox-cheat.pdf
    • http://piadaandco.it/images/roblox-games-that-give-you-robux-for-free.pdf
    • https://rietenwinkel.nl/images/free-robux-generator-v4-robuxian.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00037158.bin
c0f649c19641077b0c916d2523f3ad22bb0617e6b2c1f5cfc7fc3bfc45121400		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37158 26168 bytes
font_01_sfnt_off0003ac53.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AC53 5696 bytes
font_02_sfnt_off0003b965.bin
4880a2de7af596058a69c4d0d9cc3eca924f66f15f0c75a86aab5e01fde3d088		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B965 18588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.