Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a889568533221c9…

MALICIOUS

PDF

244.4 KB Created: 2021-04-05 02:52:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: e0c60b7a59b716c3c629f723b3a04d6d SHA-1: 08ab2d87310b835fa061001897db2d2b77ba6436 SHA-256: 5a889568533221c9e1ce898a694801926cc7423ac698270c3317098752ae5dc2
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as 'Pdf.Phishing.Roblox062100-9873116-0'. It contains an embedded URI pointing to 'http://gaminggenerator.org/app/431946152/free-ninja-animation-roblox-2021', which is likely a phishing lure related to the Roblox game. The document body, though heavily obfuscated, contains references to Roblox and animation, reinforcing the phishing theme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9350

Heuristics 3

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-ninja-animation-roblox-2021 PDF link annotation
    • http://colegioluisamigo.cl/images/roblox-play-as-guest-free-no-download.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/get-unlimited-robux-for-free.pdfIn PDF document text
    • https://lobergetart.se/images/free-robux-on-google-map.pdfIn PDF document text
    • http://www.prylfabriken.se/images/how-do-you-get-free-robux-codes.pdfIn PDF document text
    • https://bgescc.com/images/free-real-roblox-robux-genereator.pdfIn PDF document text
    • https://www.ferienhausdirektkroatien.de/images/new-not-center-roblox-hack.pdfIn PDF document text
    • http://akademiatenisa.org/images/how-to-get-robux-for-free-hack.pdfIn PDF document text
    • http://www.web.stc-part.co.th/images/dashing-simulator-roblox-hack-tutorial.pdfIn PDF document text
    • https://gaj.rs/images/comment-hacker-un-server-roblox.pdfIn PDF document text
    • https://bancroftandsons.com/images/roblox-high-vis-free.pdfIn PDF document text
    • http://jwcrownlimo.net/images/hack-dowloads-robux.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/roblox-cheat-wall-glitch-download.pdfIn PDF document text
    • http://abqwinair.com/images/hacker-pro-roblox.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/oprewards-get-free-robux.pdfIn PDF document text
    • https://osk-sibir.ru/images/roblox-free-dominus-2021.pdfIn PDF document text
    • http://principessalialaofegypt.com/images/hack-mining-simulator-roblox-2021.pdfIn PDF document text
    • http://dialine.cz/images/how-to-counter-hack-a-hacker-on-roblox.pdfIn PDF document text
    • http://www.oberberger.it/images/pastebin-free-robux-promo-codes.pdfIn PDF document text
    • https://yarburservices.ru/images/build-a-boat-roblox-hack.pdfIn PDF document text
    • https://www.milewood.co.uk/images/cheat-jailbreak-roblox-money-2021.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00037cef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37CEF 25828 bytes
SHA-256: 70e398c92288d4cec24b6d00933a3d9dcf5e113cbcc2e2ff93acfad0da6aae45

Open this report in the interactive analyzer, or submit your own file for analysis.