PDF malware analysis — malicious · 65e23c91b4ee3de3

MALICIOUS

PDF

258.4 KB Created: 2021-04-04 12:18:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-22

MD5: 9dfc11d3df3338a9f617747e53dfafdc SHA-1: 79fbbf1c9877f006691528c09709f4e10470beeb SHA-256: 65e23c91b4ee3de332ab144fbd91085ecc5df4cc58d0c79127307b866d20c09b

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a specific phishing signature related to Roblox. The document body and embedded URLs point towards a lure for free Robux, a common theme in phishing and scam operations. The presence of external URIs suggests an attempt to redirect the user to a malicious website.

Machine Learning

Nyx PDF Classifier clean score 0.0110

Heuristics 5

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/how-do-u-get-free-robux-without-builders-club PDF link annotation
- https://www.foodsafety.cz/images/free-online-games-roblox-no-download.pdfIn PDF document text
- http://garrisonjazz.com/images/roblox-free-robux-hack-pc.pdfIn PDF document text
- http://centuriatus.com/images/new-free-robux-hack-pastebin.pdfIn PDF document text
- http://alpen-seeblick.at/images/hacks-para-los-juegos-de-roblox-gratis.pdfIn PDF document text
- https://www.beaufortcollege.ie/images/get-free-roblox-robux-generator.pdfIn PDF document text
- https://www.prodex-holz.cz/images/roblox-hacks-multiplayer-game-hacks.pdfIn PDF document text
- https://sitam.co.in/images/speed-hack-roblox-jailbreak-cheat-engine.pdfIn PDF document text
- https://www.brainpads.com/images/how-to-hack-jailbreak-roblox.pdfIn PDF document text
- http://s-punkt-objects.de/images/how-to-fake-hack-roblox.pdfIn PDF document text
- https://technospektr.com.ua/images/free-robux-password-only.pdfIn PDF document text
- http://ims-77.fr/images/hack-ghost-simulator-roblox-september.pdfIn PDF document text
- http://kermas.eu/images/ideos-para-hackear-roblox.pdfIn PDF document text
- http://www.bbnest.it/images/free-tshirts-fixed-roblox.pdfIn PDF document text
- http://jdlrelocation.com/images/new-hack-roblox-2021.pdfIn PDF document text
- http://kancelaria-legnica.eu/images/free-robux-pastebin-2021.pdfIn PDF document text
- http://halitbayramoglu.com.tr/images/roblox-critical-strike-cheats.pdfIn PDF document text
- http://evp-sanorlenok.ru/images/how-to-get-free-robux-2021-link.pdfIn PDF document text
- http://egorplitka.ru/images/how-to-set-up-pf-pros-roblox-cheats.pdfIn PDF document text
- http://ohsawamacrobiotics.com/images/how-to-earn-free-robux-online.pdfIn PDF document text
- http://yogaschooldecypres.be/images/how-to-cheat-at-roblox.pdfIn PDF document text
- https://www.air-shop.cz/images/horizon-alpha-money-hack-may-2021-roblox.pdfIn PDF document text
- http://zarinnameh.ir/images/will-they-cheat-roblox-thumbnail.pdfIn PDF document text
- http://schrichte.de/images/roblox-hack-cheats-online-generator.pdfIn PDF document text
- http://ns1.radiofacil.net/images/como-ser-hacker-en-roblox-con-usb.pdfIn PDF document text
- http://caraless.com/images/play-roblox-free-online.pdfIn PDF document text
- https://www.eglihotel.gr/images/how-to-hack-in-boku-no-roblox.pdfIn PDF document text
- https://www.milewood.co.uk/images/como-hackear-roblox-robu-gratis.pdfIn PDF document text
- http://bressanassessoria.com.br/images/robux-hacks-that-actually-work-2021.pdfIn PDF document text
- http://bit-sky.com/images/how-to-hack-denis-roblox-acc.pdfIn PDF document text
- http://citycare.pt/images/roblox-free-folower-nov-2021.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00038f59.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x38F59	23576 bytes
SHA-256: `b71b93b5dfbd2d3d8e6b00bb416b8059dd3879ace3467afc482a192ce5060307`
`font_01_sfnt_off0003c4f4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3C4F4	3884 bytes
SHA-256: `40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf`
`font_02_sfnt_off0003d198.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3D198	5596 bytes
SHA-256: `9a13c2580265a78e8a7257496a31ee0055738af7e20a5661c2902efe4bf05ce5`
`font_03_sfnt_off0003de45.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3DE45	18792 bytes
SHA-256: `8ac55d8cd439cf88b1f5e45ba553a626d99236d580ea480c1bce244143c77b77`

Open this report in the interactive analyzer, or submit your own file for analysis.