PDF malware analysis — malicious · 5d8774b15806b319

MALICIOUS

PDF

54.3 KB Created: 2021-04-06 14:06:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-12

MD5: 689132644c6884be804764dd3e985df5 SHA-1: 15b796111e48764d3ca3be4177c744470585c859 SHA-256: 5d8774b15806b3192ff83334070423def426c51756369bf2c70db72bf2d1db87

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded links and a prominent call-to-action related to 'Free Robux' and game hacks. The primary link redirects to 'enigmagenerator.com', a known malicious domain associated with scams. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate a lure designed to redirect users to potentially malicious content, likely for credential harvesting or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.8413

Heuristics 4

PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://kruiz21.ru/images/hex-number-gives-free-robux-by-robuxian.pdfIn PDF document text
- http://cmfd.nl/images/my-roblox-account-got-hacked-ant.pdfIn PDF document text
- http://www.sapaengineering.kz/images/roblox-csgo-hacks.pdfIn PDF document text
- https://verdensbarn.no/images/roblox-noclip-hack-download-2021.pdfIn PDF document text
- http://egorplitka.ru/images/roblox-star-wars-hack-v3rmillion.pdfIn PDF document text
- http://www.web.stc-part.co.th/images/roblox-cheat-engine-bypass-roblox.pdfIn PDF document text
- https://jdlgroup.ca/images/roblox-lumber-tycoon-2-money-hack-2021.pdfIn PDF document text
- http://dermaceutic.co.uk/images/cheat-boku-no-roblox.pdfIn PDF document text
- http://hocquaux.fr/images/roblox-speed-hack-android.pdfIn PDF document text
- http://egorplitka.ru/images/free-robux-gropups.pdfIn PDF document text
- https://sitam.co.in/images/roblox-hack-robux-app.pdfIn PDF document text
- http://ivalor.fr/images/how-to-get-free-robux-on-phone-ios.pdfIn PDF document text
- https://esl.ipb.ac.id/images/aimbot-roblox-free.pdfIn PDF document text
- https://pemadamapi.net/images/cool-roblox-weapons-hack.pdfIn PDF document text
- http://www.danzamaniapergine.it/images/roblox-destroy-hack.pdfIn PDF document text
- https://sitam.co.in/images/fly-hack-roblox-weight-sim.pdfIn PDF document text
- http://svp-steinmaur.ch/images/free-sunglasses-in-roblox.pdfIn PDF document text
- https://corbo.ru/images/free-roblox-games-for-geust.pdfIn PDF document text
- http://leigraphics.com/images/roblox-hack-999999-robux-no-human-verification.pdfIn PDF document text
- http://uptodate.az/images/is-nexusus-roblox-hack.pdfIn PDF document text
- https://koeltotaal.com/images/roblox-ad-maker-free.pdfIn PDF document text
- http://ferienwohnung-walker.de/images/oli-zigzag-roblox-free.pdfIn PDF document text
- http://cdescolapios.org/images/hacks-for-roblox-legit-free-robux.pdfIn PDF document text
- https://www.tsdb.com.au/images/thx-hacker-for-opening-roblox-d.pdfIn PDF document text
- https://corbo.ru/images/how-to-hack-for-free-robux-2021.pdfIn PDF document text
- http://solidkom.ch/images/free-robux-com-no-verification.pdfIn PDF document text
- http://www.eptaviation.com/images/robux-hack-no-human-verification-or-survey-2021.pdfIn PDF document text
- http://www.sapaengineering.kz/images/roblox-free-model-scripts.pdfIn PDF document text
- https://luminouswisdom.org/images/hacker-banned-me-from-games-roblox.pdfIn PDF document text
- http://uptodate.az/images/roblox-sign-in-free-online.pdfIn PDF document text
- http://bassacctaxservices.com/images/best-game-naruto-all-form-free-roblox.pdfIn PDF document text
- http://lewishome.net/images/how-to-get-free-robux-and-tix-in-roblox.pdfIn PDF document text
- https://www.fhccu.com/images/roblox-download-free-ios.pdfIn PDF document text
- https://www.osoc.com/images/roblox-hack-menu-jailbreak-2021-abril.pdfIn PDF document text
- https://www.tsdb.com.au/images/roblox-jailbreak-hack-download-2021.pdfIn PDF document text
- http://www.lovecraftiana.com.ar/images/comment-avoir-un-speed-hack-et-des-roblox.pdfIn PDF document text
- http://fiur-malermeister.de/images/freetako-roblox.pdfIn PDF document text
- http://www.maakherumusic.net/images/roblox-you-were-kicked-from-this-game-do-not-cheat.pdfIn PDF document text
- http://schrichte.de/images/roblox-hack-instalar.pdfIn PDF document text
- https://www.iadh.bi/images/pet-sim-online-hack-download-roblox.pdfIn PDF document text
- https://www.millatgears.com/images/roblox-how-to-hack-with-ceat-engine.pdfIn PDF document text
- https://yarburservices.ru/images/pastebin-robux-card-hack.pdfIn PDF document text
- http://www.exikom.com.ua/images/roblox-booga-booga-mojo-fly-hack-26-may.pdfIn PDF document text
- https://www.ncscolour.no/images/roblox-cheat-engine-bypassed-2021.pdfIn PDF document text
- http://www.maakherumusic.net/images/changelog--free-codes-https-devforumrobloxcom-t-infinityrpgc.pdfIn PDF document text
- http://eastwestmacrobiotics.com/images/cheat-engine-scripts-for-roblox.pdfIn PDF document text
- http://axia-verlag.at/images/free-bandit-mask-roblox.pdfIn PDF document text
- http://www.mikramarine.gr/images/free-cute-hair-for-roblox.pdfIn PDF document text
- https://reggieslockandkey.com/images/daniel-neward-youtube-roblox-hacks.pdfIn PDF document text
+11 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000072ca.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x72CA	25640 bytes
SHA-256: `991b789848fefbeba3ca095a0b7b80380a438d222bc85915eb339cb12abd56d2`
`font_01_sfnt_off0000ace8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xACE8	19444 bytes
SHA-256: `bba5fd821a6e48dd7a38369f5e33c3ec06479dfc75d5351bce5aa3ecd41d88c9`

Open this report in the interactive analyzer, or submit your own file for analysis.