Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b1f5a5e542745fe…

MALICIOUS

PDF

241.0 KB Created: 2021-04-04 22:57:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 9a5eae09ea766f1f4ba7ede60d18342a SHA-1: 363227b992341495a4ed69dccc7a093f77f642e7 SHA-256: 5b1f5a5e542745fea9d77374e6d9c1f8c95b2248775014843d00155a843b28a6
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple heuristics indicating it's a lure for game hacks, specifically mentioning Roblox. The primary URL, http://gaminggenerator.org/app/431946152/how-to-put-music-into-any-roblox-game-hacks, is directly linked to this lure. ClamAV also detected this as Pdf.Phishing.Roblox, further supporting the phishing and malicious intent. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'Qt', suggesting it was generated by a tool rather than a standard document editor, and the presence of embedded URLs points towards a malicious redirection or download attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5773

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-put-music-into-any-roblox-game-hacks PDF link annotation
    • http://www.beged.at/images/free-robux-without-download-pc.pdfIn PDF document text
    • http://www.drent.se/images/how-to-earn-free-robux-on-phone.pdfIn PDF document text
    • https://icefuture.ru/images/free-robux-by-joining-a-group.pdfIn PDF document text
    • http://ehma.com/images/roblox-yellow-plaid-flannel-free-to-steal.pdfIn PDF document text
    • https://sectorpravdy.com/images/hackaron-roblox-download.pdfIn PDF document text
    • http://www.jureclomas.com.ar/images/roblox-hack-pastebin-com.pdfIn PDF document text
    • http://www.lascalamilanowallcovering.it/images/robux-bandit-hack.pdfIn PDF document text
    • https://arcasict.nl/images/roblox-give-tool-hack-pastebin.pdfIn PDF document text
    • http://yogaschooldecypres.be/images/i-think-i-just-got-hacked-on-roblox.pdfIn PDF document text
    • https://lesegais.ru/images/free-roblox-rip-offs.pdfIn PDF document text
    • http://www.anies.eu/images/how-to-claim-free-robux-games-real.pdfIn PDF document text
    • http://junktiquecollector.com/images/how-to-get-robux-for-free-2021.pdfIn PDF document text
    • https://bancroftandsons.com/images/how-to-make-your-roblox-shirt-free.pdfIn PDF document text
    • http://goosesscuba.com/images/are-private-servers-in-roblox-free.pdfIn PDF document text
    • http://arcnjournals.org/images/free-roblox-accounts-with-eto3k.pdfIn PDF document text
    • https://www.cfdcnv.com/images/hacks-boku-no-hero-roblox-vermillion-site-v3rmillionnet.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/free-robux-no-download-no-human-verification-2021.pdfIn PDF document text
    • http://xn--apartementos-smfora-cala-ratjada-4vc.de/images/free-dominus-roblox-console.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/how-do-you-get-free-robux-instinly.pdfIn PDF document text
    • http://kulturhusbabberich.nl/images/mega-fun-obby-games-free-play-online-not-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036bc1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36BC1 21828 bytes
SHA-256: 1eb83ad8233caa1eaec9b817e52b29d5719358632acf93fccadd26ee6b42b94a
font_01_sfnt_off00039b9b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39B9B 19068 bytes
SHA-256: 2d4f37a0e53ee4259b5070b0d4fba70fdaf14b4707ee8e5de080a9ae1c267af2

Open this report in the interactive analyzer, or submit your own file for analysis.