Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e0b65f119b38b99…

MALICIOUS

PDF

42.7 KB Created: 2021-04-03 23:03:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 5b0d2c17fe9dac05057a0cfbe6113213 SHA-1: a69411bb5388a64b82006221c38bd5c7714290b0 SHA-256: 6e0b65f119b38b9943920f1a87146f4418f54869983a80824a869bf2fd80d3a1
132 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9175

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/redline-roblox-cheat-mega PDF link annotation
    • http://www.eurosan1.ba/images/how-to-get-free-avartar-shings-on-roblox.pdf%0AIn PDF document text
    • http://nevesomost.by/images/free-custom-script-runner-roblox.pdf%0AIn PDF document text
    • https://technospektr.com.ua/images/i-can-hack-u-robux.pdf%0AIn PDF document text
    • https://www.lomrad.go.th/images/whatever-floats-your-boat-roblox-hack.pdf%0AIn PDF document text
    • http://www.copoint.co.uk/images/earngg-free-robux.pdf%0AIn PDF document text
    • http://www.nielsen2u.dk/images/free-fallin-roblox-id.pdf%0AIn PDF document text
    • https://www.udivadlahotel.cz/images/hack-copy-game-roblox.pdf%0AIn PDF document text
    • http://www.vktzunami.cz/images/free-robux-discord-group.pdf%0AIn PDF document text
    • http://www.awakeningtruth.org/images/descargar-roblox-para-android-hack.pdf%0AIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/roblox-urbis-hack-with-cheat-engine.pdf%0AIn PDF document text
    • http://uctovnictvosnv.sk/images/hacking-roblox-pastebin.pdf%0AIn PDF document text
    • https://www.albisser.ch/images/roblox-what-day-is-restarunt-tycoon-2-coming-for-free.pdf%0AIn PDF document text
    • https://amatq.ca/images/roblox-elemental-battlegrounds-speed-hack.pdf%0AIn PDF document text
    • http://medimacs.eu/images/can-i-download-roblox-for-ps3-free.pdf%0AIn PDF document text
    • http://learningarabic.co.uk/images/free-robux-hack-generator-pc.pdf%0AIn PDF document text
    • http://www.lionel-seppoloni.fr/images/vortexx-roblox-free-robux-pastebin.pdf%0AIn PDF document text
    • http://www.zdravazena.sk/images/how-to-hack-shirts-on-roblox.pdf%0AIn PDF document text
    • http://www.drent.se/images/roblox-how-to-get-free-robux-without-hacks.pdf%0AIn PDF document text
    • http://learningarabic.co.uk/images/free-roblox-accounts-that-work-2021.pdf%0AIn PDF document text
    • http://www.zdravazena.sk/images/adopt-me-roblox-hack-place.pdf%0AIn PDF document text
    • http://learningarabic.co.uk/images/hack-courir-super-vite-roblox-jailbreak.pdf%0AIn PDF document text
    • http://www.kalaaliaraq.dk/images/youtube-hack-any-roblox-account-no-loading.pdf%0AIn PDF document text
    • http://asiashop-france.fr/images/how-to-make-vip-server-in-roblox-for-free.pdf%0AIn PDF document text
    • http://www.brtes.com/images/nuvos-hack-de-roblox-6-05-2021.pdf%0AIn PDF document text
    • https://kimolos-link.gr/images/roblox-robux-free-bc.pdf%0AIn PDF document text
    • https://fkg.usu.ac.id/images/how-to-get-free-stuff-on-roblox-2021.pdf%0AIn PDF document text
    • http://www.anies.eu/images/how-can-you-earn-robux-for-free.pdf%0AIn PDF document text
    • http://www.eurologistiki.gr/images/what-is-the-easiest-way-to-get-free-robux.pdf%0AIn PDF document text
    • http://pa-tanjungselor.go.id/images/hack-roblox-using-termux.pdf%0AIn PDF document text
    • http://www.remiauclair.fr/images/roblox-jailbreak-hack-money-generator.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off000042d1.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000042d1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x42D1 24080 bytes
SHA-256: a81fa78f52983003c07ae236fd9f471de781ab7649cfff1c0289dba4910740f0
font_01_sfnt_off0000790b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x790B 2956 bytes
SHA-256: 7afcbc6afeafc927d10c29b8cc09bc3a46870eb52793bc1217b542c68b3b1aca
font_02_sfnt_off0000834a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x834A 18300 bytes
SHA-256: 3052c333f19c2f9bf953fd30c1bbff6bd9fd896e89fb6646abc67d105007ff17

Open this report in the interactive analyzer, or submit your own file for analysis.