Malicious PDF — malware analysis report

Static analysis result for SHA-256 5746e1384bfcfc6a…

MALICIOUS

PDF

56.3 KB Created: 2021-04-06 16:24:34 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 7eff373152f47a81282b688174e0dadd SHA-1: 0680b119ed1af69d4e6789f514668c236b41e4ec SHA-256: 5746e1384bfcfc6a391ab1e75eadc815ea1d631b2918279fc30604d19d0e711c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple heuristics indicating a lure for game hacks and free in-game currency, specifically 'Robux'. The document body and extracted URLs point to websites offering such cheats, which is a common pretext for phishing or malware distribution. While no scripts were directly extracted, the PDF structure and embedded links suggest a malicious workflow designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6397

Heuristics 5

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://e-onlinearchiv.de/images/free-robux-no-human-verification-jeuxvideocom.pdfIn PDF document text
    • https://verdensbarn.no/images/free-card-codes-roblox-2021-no-survey-no-download.pdfIn PDF document text
    • http://vgsiemens.nl/images/roblox-how-to-get-free-clothes-ios.pdfIn PDF document text
    • https://www.tsdb.com.au/images/free-bugatti-in-roblox-jailbreak.pdfIn PDF document text
    • http://www.oberberger.it/images/20210-robux-free.pdfIn PDF document text
    • https://www.ergolight.at/images/how-to-look-like-a-hacker-in-roblox-for-free.pdfIn PDF document text
    • http://gruporamos.do/images/roblox-walk-through-walls-hack-download.pdfIn PDF document text
    • https://www.mvp.co.nz/images/cheat-mod-roblox.pdfIn PDF document text
    • http://www.studiomilone.net/images/is-hacking-illegal-in-roblox.pdfIn PDF document text
    • https://allpi.int/images/free-robux-hack-no-human-verification-pc.pdfIn PDF document text
    • http://bagna.pl/images/free-robux-with-no-human-verification.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/roblox-hack-robux-2021-android.pdfIn PDF document text
    • http://dorfgaragethalwil.ch/images/fun-robux-hack.pdfIn PDF document text
    • http://pia2000.net/images/free-roblox-followers-no-survey.pdfIn PDF document text
    • http://www.guidaturisticaverona.it/images/free-robux-addons.pdfIn PDF document text
    • http://www.eaapiaria.es/images/how-to-hack-roblox-game-2021.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/free-safe-roblox-exploits.pdfIn PDF document text
    • http://www.pacoestrada.it/images/roblox-zombie-rush-cheat.pdfIn PDF document text
    • http://ff-obertraun.at/images/cheats-roblox-tickets.pdfIn PDF document text
    • http://www.pro-futuro.eu/images/get-400-robux-for-free.pdfIn PDF document text
    • http://standart-lab.ru/images/jailbreak-free-money-roblox.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/ash-greninja-free-shopping-in-roblox-on-roblox-shopping-shir.pdfIn PDF document text
    • http://ordineingsa.it/images/download-roblox-outfits-for-free.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/hack-phamtom-forces-roblox-2021.pdfIn PDF document text
    • http://dottgagliardi.com/images/the-best-roblox-hack-tool.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/free-roblox-codes-2021-a-buch-of-uses.pdfIn PDF document text
    • http://energyline.co/images/roblox-promo-codes-for-free-stuff.pdfIn PDF document text
    • http://danielkleiboemer.de/images/how-to-get-free-robux-2021.pdfIn PDF document text
    • http://lekarinfo.mk/images/roblox-free-colouring-pages.pdfIn PDF document text
    • https://bapalaye.org/images/how-to-get-free-robux-insert.pdfIn PDF document text
    • http://avd-weiden.bayern/images/fast-to-use-roblox-hack-scrpits.pdfIn PDF document text
    • http://76remont-kvartir.ru/images/how-to-get-a-lot-of-robux-for-free-2021.pdfIn PDF document text
    • https://digitalsenseafrica.com.ng/images/roblox-free-roblox-cards-2021.pdfIn PDF document text
    • https://wandersuechtig.de/images/my-roblox-account-got-hacked-flamingo.pdfIn PDF document text
    • http://sscclc.edu.ec/images/testing-5-ways-to-get-free-robux.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/roblox-wipeout-beta-hack.pdfIn PDF document text
    • http://www.copoint.co.uk/images/roblox-cheats-for-free-tix.pdfIn PDF document text
    • http://gitagasht.com/images/sk8-hack-roblox.pdfIn PDF document text
    • http://www.elleventi.it/images/how-to-get-free-robux-with-cheat-engine-2021.pdfIn PDF document text
    • https://hbpbenin.com/images/free-roblox-game-card-codes-2021.pdfIn PDF document text
    • http://www.mediaxin.net/images/roblox-dashing-simulator-hacks.pdfIn PDF document text
    • http://lichtdrukkerijwijchen.nl/images/2021-free-robux-hacks.pdfIn PDF document text
    • http://stackideas.com/images/roblox-cheat-codes-for-jailbreak.pdfIn PDF document text
    • http://www.mcveicolicommerciali.it/images/comment-avoir-des-robux-free.pdfIn PDF document text
    • http://www.inservis.cl/images/roblox-someone-hacked-my-account-and-traded.pdfIn PDF document text
    • https://gomsa.nl/images/how-do-you-get-free-robux-on-ipad.pdfIn PDF document text
    • https://meltonschool.org/images/work-at-pizza-place-roblox-hack.pdfIn PDF document text
    • http://www.fluidtech.hu/images/free-dinis-daily-roblox-shirt.pdfIn PDF document text
    • https://farmaciadelbivio.it/images/roblox-walk-through-walls-hack-2021.pdfIn PDF document text
    +18 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006f86.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6F86 25184 bytes
SHA-256: 025bb7922fb8f2afd22a318958733ed1bc0ee1b43a73c1528621c93ecad330f6
font_01_sfnt_off0000a88b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA88B 3312 bytes
SHA-256: 40bd8eebcb3a0d68a8646f1930e84f30a44bfa48525263c6c528f0bc1e9c1677
font_02_sfnt_off0000b3da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB3DA 19640 bytes
SHA-256: 66d33dc8477ac643c7ff9a048034bbfb56e171ddb329ae5618fcd8ceb84e6abf

Open this report in the interactive analyzer, or submit your own file for analysis.