Malicious PDF — malware analysis report

Static analysis result for SHA-256 58c0faa8ae081492…

MALICIOUS

PDF

60.0 KB Created: 2021-04-02 06:41:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-24
MD5: d14d79ce66ea5bf861b43253103c8943 SHA-1: 8a9cfa667a4bda73a616daaf4397b6bfe00b8070 SHA-256: 58c0faa8ae0814922226d67d7973c14586233fa6a4022bdb0288e35d207f86b5
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous links and references to game hacks and free in-game currency, specifically targeting Roblox players. The heuristic firings indicate a link farm designed to lure users to scam websites. While no scripts were extracted, the document body and heuristics strongly suggest a phishing or scamming attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4129

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-jailbreak-2021-hack PDF link annotation
    • https://www.academyocgc.gr/images/como-meterse-hacks-en-roblox.pdfIn PDF document text
    • https://www.cpnf.ch/images/all-free-promo-codes-in-roblox-2021.pdfIn PDF document text
    • https://amatq.ca/images/free-robux-no-survey.pdfIn PDF document text
    • https://www.lions.org.pl/images/free-code-carte-roblox.pdfIn PDF document text
    • http://www.vktzunami.cz/images/roblox-lua-script-hacks-gui.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/real-robux-hack.pdfIn PDF document text
    • https://www.siaeag.fr/images/hacker-net-roblox.pdfIn PDF document text
    • http://tte.co.in/images/completely-free-robux.pdfIn PDF document text
    • http://domaizdereva24.ru/images/free-robux-generator-no-human-verification-2021-ios.pdfIn PDF document text
    • http://www.diariotermal.com.ar/images/treasure-hunt-simulator-roblox-hack.pdfIn PDF document text
    • http://www.arma-tek.com.tr/images/hack-cliens-for-roblox-cheat-engine.pdfIn PDF document text
    • http://www.tonlesap.gov.kh/images/roblox-obby-gives-you-free-robux.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/all-roblox-free-items.pdfIn PDF document text
    • http://www.bg-da.eu/images/no-hack-free-robux.pdfIn PDF document text
    • https://www.udivadlahotel.cz/images/how-to-aimbot-hack-on-roblox.pdfIn PDF document text
    • http://www.arma-tek.com.tr/images/cheats-for-geting-robux.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/how-to-get-free-money-on-jailbreak-roblox.pdfIn PDF document text
    • https://technospektr.com.ua/images/javascript-free-robux-hack.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/robux-hack-download-for-pc.pdfIn PDF document text
    • http://echosvoix.ch/images/how-to-hack-any-pokemon-into-project-pokemon-roblox.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/free-things-in-roblox-2021.pdfIn PDF document text
    • http://cosver.eu/images/free-robux-with-private-group.pdfIn PDF document text
    • https://www.udivadlahotel.cz/images/free-fighting-roblox-game.pdfIn PDF document text
    • http://www.centrul-mara.ro/images/comment-faire-marcher-synapse-hack-roblox.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/lila-plays-free-robux.pdfIn PDF document text
    • https://accord.kiev.ua/images/free-robux-codes-2021-live.pdfIn PDF document text
    • http://www.copoint.co.uk/images/get-free-robux-today-no-human-verification.pdfIn PDF document text
    • https://www.intro-marketing.hr/images/there-is-no-way-to-get-free-robux.pdfIn PDF document text
    • https://www.modellflug-mieming.at/images/free-roblox-gift-card-codes-septemer-28-2021.pdfIn PDF document text
    • https://jdlgroup.ca/images/how-to-speed-hack-roblox-cheat-engine.pdfIn PDF document text
    • http://tsj-inform.ru/images/a-wolf-or-other-roblox-hack.pdfIn PDF document text
    • http://lax.co.in/images/amon-magi-roblox-free.pdfIn PDF document text
    • http://learningarabic.co.uk/images/how-to-get-infinite-robux-hack.pdfIn PDF document text
    • https://technospektr.com.ua/images/how-do-you-hack-roblox-to-get-robux.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/how-do-you-hack-roblox-account-2021.pdfIn PDF document text
    • https://www.sinaloadiario.mx/images/free-roblox-accounts-login-august-2021.pdfIn PDF document text
    • http://www.gadanie.lv/images/free-paint-hwo-to-draw-a-realist-eye-roblox.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/roblox-script-executor-free-sk8r.pdfIn PDF document text
    • http://www.evaplast.by/images/free-roblox-hack-2021.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/how-do-you-earn-robux-in-roblox-for-free.pdfIn PDF document text
    • https://www.foodsafety.cz/images/free-robux-today-easy.pdfIn PDF document text
    • https://www.yewtreealpacas.co.uk/images/roblox-how-to-get-tge-free-trial-trial-bc.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/how-to-get-free-robux-via-group.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/how-to-hack-roblox-accounts-passwords-online.pdfIn PDF document text
    • https://accord.kiev.ua/images/money-hack-roblox-galaxy.pdfIn PDF document text
    • http://www.anies.eu/images/roblox-robux-hack-2021.pdfIn PDF document text
    • http://www.marambio.com.ar/images/roblox-makes-robux-items-free.pdfIn PDF document text
    • http://www.arba.vn/images/how-to-get-robux-for-free-2021.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/robux-hack-fr.pdfIn PDF document text
    +52 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00008c28.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8C28 23940 bytes
SHA-256: 6c1d99740a71609c56a5c126b03df74df9ec82e436526702485179f73c3b9b29
font_01_sfnt_off0000c29c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC29C 18240 bytes
SHA-256: 36873691943cfb1ca40f679340521387cdd38ad87ea2884c62e0333c5893f0c0