Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c944de4838c96dd…

MALICIOUS

PDF

245.8 KB Created: 2021-04-05 00:58:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 869f6024897d05d8c9e13cffce9fe329 SHA-1: d26af3d3c5784091ff3b7af70d419aac1a4ac303 SHA-256: 6c944de4838c96ddc2f933afea36926462ea96ec36a09b1ccd7ad7ae44edf4dd
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with a phishing detection. The document body and heuristics indicate a social engineering lure, specifically a browser extension or update installation prompt, which is a common tactic for credential theft or malware delivery. Numerous external URLs were extracted, many pointing to PDF files related to 'Roblox' and 'free Robux', suggesting a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2693

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-free-to-take-group PDF link annotation
    • http://batutynas.lt/images/free-robux-hack-uk.pdfIn PDF document text
    • http://moto98.com/images/free-robux-from-a-game.pdfIn PDF document text
    • http://korporacjaroma.pl/images/roblox-robux-hackercom.pdfIn PDF document text
    • http://brokermortgages.com/images/roblox-free-robux-android.pdfIn PDF document text
    • https://www.laarsenco.nl/images/hacking-brothers-roblox-account.pdfIn PDF document text
    • http://www.eurosan1.ba/images/how-to-cheat-in-roblox-mad-paintball.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/free-roblox-gift-card-codes-not-used-2021.pdfIn PDF document text
    • http://news123.it/images/how-to-get-free-robux-hack-2021.pdfIn PDF document text
    • https://shimony.net/images/how-to-get-free-robux-mythical-chaos.pdfIn PDF document text
    • https://belixconstructions.com.au/images/roblox-script-hack-list.pdfIn PDF document text
    • http://greenoase.be/images/how-to-get-free-face-in-roblox-2021.pdfIn PDF document text
    • https://www.seeingindependence.org/images/how-to-get-any-item-for-free-in-roblox-2021.pdfIn PDF document text
    • http://abqwinair.com/images/roblox-hack-2021-pc.pdfIn PDF document text
    • http://www.rezbb.sk/images/free-robux-generator-that-actually-works-no-human-verification.pdfIn PDF document text
    • http://dennemaat.nl/images/roblox-hacks-no-virus-100-working.pdfIn PDF document text
    • https://tokunfome.com.br/images/free-robux-lgit.pdfIn PDF document text
    • https://schulzpressetext.de/images/how-to-hack-granny-roblox.pdfIn PDF document text
    • http://ernstgloves.co.il/images/free-robux-groups-2021.pdfIn PDF document text
    • https://arcasict.nl/images/earnrobux-gg-earn-free-robux-for-roblox.pdfIn PDF document text
    • http://grahambettsmotors.com/images/how-to-kill-anyone-in-roblox-hacks.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00037afb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37AFB 24036 bytes
SHA-256: 97799f2809e19b30612066f762fe565a9b8db83cc7b96ee20adf790bb0f85217
font_01_sfnt_off0003b1d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B1D2 17896 bytes
SHA-256: e31c4b516fe19c831a9bab701dacea357fc43d16576b64697b92d3ce301d6b40

Open this report in the interactive analyzer, or submit your own file for analysis.