Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f176b468c7c497c…

MALICIOUS

PDF

61.8 KB Created: 2021-04-06 01:45:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 81e7da2578794e80ad87cfa1a723c5b6 SHA-1: f21c5ce1ceb603e8b00e2444fdec5911e62b84a5 SHA-256: 5f176b468c7c497c567c1b583db8a55495856b295f0322d5df95cd104f7ca2bd
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites that claim to offer game hacks and free in-game currency, such as Robux. These links are part of a link farm designed to lure users into potentially malicious sites. The ML classifier also flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 6

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-free-candy-van-exploit PDF link annotation
    • http://florentineholding.com/images/los-mejores-hacks-para-roblox-cheskoo.pdfIn PDF document text
    • http://behsanroshd.com/images/roblox-robux-hack-virus-free.pdfIn PDF document text
    • https://www.appartamenticroazia24.com/images/roblox-prison-life-hack-pastebin.pdfIn PDF document text
    • http://interpretation-dessins-enfants.net/images/robux-hack-tool-android.pdfIn PDF document text
    • http://www.mikramarine.gr/images/roblox-secret-free-items.pdfIn PDF document text
    • http://spstrading-th.com/images/free-robux-installer.pdfIn PDF document text
    • http://domaizdereva24.ru/images/cmo-hackear-el-roblox-para-tener-robux-en-un-mvil.pdfIn PDF document text
    • http://shahriyarclimb.com/images/usando-hacks-en-roblox.pdfIn PDF document text
    • http://axiapublishers.com/images/free-targets-roblox.pdfIn PDF document text
    • http://dubwar.pl/images/yin-vs-yang-roblox-cheat.pdfIn PDF document text
    • http://ohsawamacrobiotics.com/images/how-to-create-a-shirt-for-free-on-roblox.pdfIn PDF document text
    • http://condit-pack.com/images/roblox-jailbreak-cheat-noclip.pdfIn PDF document text
    • http://lv-siegen.de/images/how-to-hack-in-roblox-murderer-mystery-2.pdfIn PDF document text
    • http://www.inservis.cl/images/roblox-work-at-a-pizza-place-money-hack.pdfIn PDF document text
    • http://keepcasscountybeautiful.com/images/roblox-weight-lifting-simulator-2-hack.pdfIn PDF document text
    • http://www.maakherumusic.net/images/roblox-how-to-make-a-tshirt-free.pdfIn PDF document text
    • https://www.eglihotel.gr/images/robux-generator-hack-tool.pdfIn PDF document text
    • http://innovativefs.co.uk/images/noob-skin-roblox-free.pdfIn PDF document text
    • http://stpc.it/images/free-roblox-accounts-2021-with-robux-bugmenot.pdfIn PDF document text
    • http://dermaceutic.co.uk/images/cheat-codes-for-roblox-mad-paint-ball-2.pdfIn PDF document text
    • https://kimolos-link.gr/images/free-roblox-gift-cards-that-can-be-used-unlimited-times.pdfIn PDF document text
    • http://j-cook.pro/images/robux-hack-v6-5-pastebin.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/roblox-speed-hack-mac.pdfIn PDF document text
    • https://kimolos-link.gr/images/roblox-murder-mystery-2-wls-3-hack.pdfIn PDF document text
    • https://verdensbarn.no/images/free-robux-hack-for-2021-mystic-plays.pdfIn PDF document text
    • http://www.remiauclair.fr/images/comment-avoir-le-free-skin-de-strucid-roblox.pdfIn PDF document text
    • http://baah.ca/images/roblox-free-hats-code.pdfIn PDF document text
    • http://evro-okna.net/images/get-free-robux-without-survey.pdfIn PDF document text
    • https://www.ncscolour.no/images/how-to-hack-on-roblox-in-3-simple-steps.pdfIn PDF document text
    • https://ai-appenzell.ch/images/sop-free-private-server-roblox.pdfIn PDF document text
    • https://domoticaaplicada.com/images/free-generator-code-roblox.pdfIn PDF document text
    • http://halitbayramoglu.com.tr/images/robux-hack-ohne-handy.pdfIn PDF document text
    • http://geopaper.ge/images/free-robux-real-without-email-needed.pdfIn PDF document text
    • http://vagency.us/images/hack-for-robux-roblox.pdfIn PDF document text
    • http://www.fvsspa.com/images/how-to-get-free-robux-ez-ways.pdfIn PDF document text
    • http://riccardodurso.it/images/roblox-accessoire-free-2021.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/how-to-get-free-robux-creag.pdfIn PDF document text
    • http://farwesterndistrict.org/images/free-robux-2021-10-working-legit.pdfIn PDF document text
    • https://inscastellar.cat/images/how-to-make-a-group-for-free-on-roblox-2021.pdfIn PDF document text
    • http://www.vktzunami.cz/images/roblox-infinite-ammo-hack-2021.pdfIn PDF document text
    • http://uo-nn.ru/images/cheats-roblox-counter-strike-wallhack-aimbot.pdfIn PDF document text
    • http://learningarabic.co.uk/images/counter-blox-roblox-offensive-free-skins.pdfIn PDF document text
    • https://www.smartitbg.com/images/roblox-free-robux-download-2021.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/free-roblox-account-giveaway-with-robux.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/cheat-list-roblox.pdfIn PDF document text
    • http://fairwaygolftravel.co.uk/images/can-you-get-roblox-for-free-on-xbox-360.pdfIn PDF document text
    • http://www.cosver.nl/images/youtube-free-robux-promo-codes.pdfIn PDF document text
    • http://domaizdereva24.ru/images/roblox-hacks-for-apocalypse-rising.pdfIn PDF document text
    • http://seytarehco.com/images/roblox-simulator-hack.pdfIn PDF document text
    +19 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008262.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8262 27192 bytes
SHA-256: b7a499b559dda710623538bebd428e04b0f56c7c53f07281216340774c1f747f
font_01_sfnt_off0000c0b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC0B0 3884 bytes
SHA-256: 40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf
font_02_sfnt_off0000cd57.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD57 18460 bytes
SHA-256: cbf7fbafb918bf5b039e24e842f5a52fa9d8ef3a3c9a29e4aa10baa875551d52