PDF malware analysis — malicious · 64875b530fa39650

MALICIOUS

PDF

59.9 KB Created: 2021-04-05 22:07:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-07

MD5: 14ab865ce0dcdff10e03e9fe77bcb8b0 SHA-1: fe33cdb317aa5a2cabd020bfb7174dff1c37fe11 SHA-256: 64875b530fa39650c4f3435e7779382736d66e5c7cc9c268f35e64df016ad2d6

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains multiple heuristics indicating a credential phishing and malware delivery attempt. It impersonates Microsoft, uses a lure related to "Roblox Hack Channel Art", and directs users to external URLs. The document body also contains a URL that is likely intended to lead the user to download a malicious payload or provide sensitive information.

Machine Learning

Nyx PDF Classifier malicious score 0.6193

Heuristics 5

Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/roblox-hack-channel-art.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/roblox-hack-channel-art PDF link annotation
- http://goosesscuba.com/images/who-hacked-roblox-to-change-the-thumbnails-of-games.pdfIn PDF document text
- http://ekaterinakorneva.com/images/how-to-hack-in-roblox-prison-life-2021.pdfIn PDF document text
- http://domaizdereva24.ru/images/list-of-free-roblox-items.pdfIn PDF document text
- http://www.torvet11.dk/images/how-to-get-the-void-star-in-roblox-for-free.pdfIn PDF document text
- http://www.lascalamilanowallcovering.it/images/free-shirt-roblox-youtube.pdfIn PDF document text
- http://fairwaygolftravel.co.uk/images/how-do-you-get-free-robux-on-ipad-2021.pdfIn PDF document text
- http://adues.org/images/bowy-roblox-hacker.pdfIn PDF document text
- https://www.gletthofer.at/images/how-to-hack-all-roblox-games-pc.pdfIn PDF document text
- http://cleanteclogistics.com/images/get-free-robux-on-ipad.pdfIn PDF document text
- https://bancroftandsons.com/images/cheat-roblox-jvc.pdfIn PDF document text
- http://killebergsridsport.se/images/roblox-hack-2021-cheat-engine-2021.pdfIn PDF document text
- https://cdu-lengerich.de/images/free-script-injector-for-roblox-v3rm.pdfIn PDF document text
- http://gbp-trabkiwielkie.pl/images/comoponerse-hacks-en-roblox.pdfIn PDF document text
- http://xn--apartementos-smfora-cala-ratjada-4vc.de/images/how-to-hack-money-in-roblox-tycoons.pdfIn PDF document text
- https://reggieslockandkey.com/images/hack-sicript-free-roblox.pdfIn PDF document text
- https://www.porthos.it/images/roblox-its-free-id.pdfIn PDF document text
- https://sitam.co.in/images/script-fly-roblox-hack.pdfIn PDF document text
- http://aviaprofsoyuz.info/images/roblox-cheat-enjen.pdfIn PDF document text
- https://www.ghknights.org/images/cheat-engine-roblox-robux-hack.pdfIn PDF document text
- http://bibliotheque-perrigny-les-dijon.fr/images/free-robux-hack-no-email.pdfIn PDF document text
- https://www.ghknights.org/images/shinobi-life-roblox-hack-onyx-2021.pdfIn PDF document text
- http://genialica.de/images/fast-food-tycoon-free-roblox.pdfIn PDF document text
- http://smart-pro.co.uk/images/roblox-build-to-survive-zombies-cheats.pdfIn PDF document text
- http://grand-ural74.ru/images/free-robux-and-builders-club-microsoft.pdfIn PDF document text
- http://www.vktzunami.cz/images/hack-robar-cuentas-de-roblox-pastebin.pdfIn PDF document text
- http://nikabio.com/images/free-robux-no-verify.pdfIn PDF document text
- http://medimacs.eu/images/free-stuff-in-roblox-catalog-2021.pdfIn PDF document text
- https://www.u-pin-it.com/images/how-to-hack-someones-account-in-roblox-easy.pdfIn PDF document text
- http://racunari.in.rs/images/how-to-play-welcome-to-bloxburg-on-roblox-for-free.pdfIn PDF document text
- http://aadvanderklaauw.nl/images/roblox-mod-apk-free-shopping.pdfIn PDF document text
- http://fotoflas.gr/images/free-roblox-no2-copy.pdfIn PDF document text
- http://iricamidelcuore.it/images/roblox-exploit-dolphin-hacks.pdfIn PDF document text
- http://www.htc.edu.au/images/secret-forums-released-free-robux-duplicator-100-working.pdfIn PDF document text
- http://www.eptaviation.com/images/roblox-catalog-free-robux.pdfIn PDF document text
- https://pagadder.com/images/roblox-renders-free.pdfIn PDF document text
- http://sealysports.com/images/how-to-do-the-hair-hack-on-roblox.pdfIn PDF document text
- http://www.inservis.cl/images/roblox-hack-generator-2021.pdfIn PDF document text
- https://belixconstructions.com.au/images/who-hacked-ezrahandjacob-in-roblox.pdfIn PDF document text
- http://jdlwealth.com/images/free-robux-generator-may-2021.pdfIn PDF document text
- https://www.elevage-chiot.fr/images/working-robux-pastebin-hack.pdfIn PDF document text
- http://instrutech.co.th/images/join-the-group-for-free-robux.pdfIn PDF document text
- http://salantiskis.lt/images/roblox-restaurant-tycoon-hack-script-pastebin.pdfIn PDF document text
- http://kaleasm.org/images/how-to-hack-a-roblox-hacker.pdfIn PDF document text
- http://www.herricht.at/images/cache-http-freerobuxclub.pdfIn PDF document text
- https://plumbingmedics.com/images/como-hackear-comandos-de-roblox.pdfIn PDF document text
- http://www.visiblefilm.com/images/cheat-roblox-android.pdfIn PDF document text
- http://danielkleiboemer.de/images/how-to-hack-roblox-android-step-by-step-anddoid.pdfIn PDF document text
- http://www.fluidtech.hu/images/denis-free-admin-town-roblox.pdfIn PDF document text
- http://iluvlocalplaces.com/images/i-want-to-break-free-roblox-music-video.pdfIn PDF document text
+15 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00008141.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8141	25344 bytes
SHA-256: `b9271291986b990995d8930e137f1f06df0da022af8b8dfd708c87d67268e5b4`
`font_01_sfnt_off0000baf0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBAF0	3884 bytes
SHA-256: `40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf`
`font_02_sfnt_off0000c797.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC797	17984 bytes
SHA-256: `7031af7eb20019ef7bfd2289e17d9b374038890654d123d9877829b4e93e8c29`

Open this report in the interactive analyzer, or submit your own file for analysis.