Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e4124d1b118c338…

MALICIOUS

PDF

53.4 KB Created: 2021-04-06 12:54:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 2ebc618727896fd0ebffaa9ac2d99335 SHA-1: 96d762c963f455db52c2774eaed6ec9fd0952a42 SHA-256: 6e4124d1b118c338f477886ed58f27259b23276124831df1b97953d80fdbdeb5
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous links and a call-to-action phrase, all related to 'Roblox hacks' and 'free Robux'. The primary lure directs users to 'enigmagenerator.com', a known malicious domain associated with scams. While no scripts were explicitly extracted, the PDF structure and embedded URIs strongly suggest a phishing or malware distribution attempt, likely using embedded JavaScript to facilitate redirection or exploit vulnerabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9173

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • https://corbo.ru/images/how-to-hack-roblox-accounts-on-mobile.pdfIn PDF document text
    • http://moralcenter.or.th/images/rblx-gg-free-robux-without-human-verification.pdfIn PDF document text
    • http://parafia-nspj-lebork.pl/images/free-robux-and-tix-tricks-amp.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/roblox-jailbreak-hack-download-speed.pdfIn PDF document text
    • https://www.albisser.ch/images/how-to-get-free-robux-on-roblox-pc-2021.pdfIn PDF document text
    • http://www.bernerpupping.at/images/roblox-booga-booga-cheat-engine.pdfIn PDF document text
    • http://kruiz21.ru/images/free-roblox-codes-2021.pdfIn PDF document text
    • http://iluvlocalplaces.com/images/what-to-do-if-my-roblox-account-gets-hacked.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/how-to-professionally-hack-roblox.pdfIn PDF document text
    • https://www.shin.ge/images/roblox-free-drawn.pdfIn PDF document text
    • http://www.centrodelsorriso.it/images/robloxs-hack-site.pdfIn PDF document text
    • http://ivanflores.cl/images/roblox-hack-no-survey-no-download-2021.pdfIn PDF document text
    • http://www.popikalogirou-realestate.gr/images/how-to-get-free-robux-javascript.pdfIn PDF document text
    • http://verenacrow.at/images/how-to-hack-accounts-on-roblox-2021.pdfIn PDF document text
    • https://cbiinc.org/images/how-to-prevent-free-model-hack-for-roblox-sudito.pdfIn PDF document text
    • http://bvmg.nl/images/free-robux-easy-for-kids-fof-noobs.pdfIn PDF document text
    • http://szekelymozes.ro/images/free-robux-penut.pdfIn PDF document text
    • http://nikabio.com/images/codes-for-free-roblox-items.pdfIn PDF document text
    • https://www.lavigny.ch/images/free-robux-android-zephplayz.pdfIn PDF document text
    • http://axia-verlag.at/images/admin-hack-roblox-2021-download.pdfIn PDF document text
    • http://eddieblum.nl/images/how-to-get-robux-by-hacking-website.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/free-roblox-adopt-me-money.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/cheat-mod-roblox.pdfIn PDF document text
    • http://racunari.in.rs/images/roblox-final-stand-cheat.pdfIn PDF document text
    • https://verdensbarn.no/images/vb-2win-live-free-robux.pdfIn PDF document text
    • http://dshikr.ru/images/how-to-get-free-robux-on-a-lg-phone.pdfIn PDF document text
    • http://greasley.online/images/roblox-wanted-hack.pdfIn PDF document text
    • https://gigbagwinkel.nl/images/carte-de-roblox-hack-gratuit.pdfIn PDF document text
    • http://fccsms.com/images/how-to-hack-peoples-account-roblox.pdfIn PDF document text
    • https://ceranique.nl/images/roblox-cheats-admin-commands.pdfIn PDF document text
    • http://kontaktadig.se/images/how-to-become-headless-in-roblox-for-free.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/leah-ashe-roblox-royale-high-how-to-get-free-things.pdfIn PDF document text
    • http://www.actae.gr/images/hack-de-free-drive-roblox.pdfIn PDF document text
    • http://unc-europe.com/images/roblox-redline-cheat.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/roblox-hack-robux-unlimited-free-on-android-ios-100-working.pdfIn PDF document text
    • http://texnes-plus.gr/images/hack-roblox-bee-swarm-simulator-apk.pdfIn PDF document text
    • http://awakeningtruth.org/images/roblox-high-school-money-hack-2021.pdfIn PDF document text
    • http://www.boic.nl/images/omfg-check-cashes-v3-speed-hack-working-roblox.pdfIn PDF document text
    • http://vedrachemicals.ro/images/how-to-deal-with-hacker-in-roblox.pdfIn PDF document text
    • http://urezerv.com/images/free-robux-givway.pdfIn PDF document text
    • http://www.sfakia-online.com/images/how-to-give-robux-to-friends-for-free.pdfIn PDF document text
    • http://serviio.org/images/a-roblox-hack-to-get-all-money-in-jailbreak.pdfIn PDF document text
    • https://ogm-goettingen.de/images/how-to-change-your-name-for-free-roblox.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/roblox-hide-and-seek-free-online-game-for-kids.pdfIn PDF document text
    • http://solidkom.ch/images/robux-hack-no-human-verification-no-survey-2021.pdfIn PDF document text
    • http://seniornetwanganui.org.nz/images/hack-roblox-games-easy.pdfIn PDF document text
    • http://vokna.by/images/lua-script-hack-dinosaur-simulator-roblox.pdfIn PDF document text
    • http://mycounty.com.ua/images/free-robux-no-hack-no-survey-no-human-verification.pdfIn PDF document text
    • http://berntfoto.dk/images/promo-codes-for-free-clothes-roblox-2021.pdfIn PDF document text
    +15 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006e09.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6E09 26184 bytes
SHA-256: 559ad5353c80fdae24e338d972de0965d38c3cc9c6ca776032c25bfaac133db4
font_01_sfnt_off0000ab56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAB56 18804 bytes
SHA-256: 23e34c2913096df39fe97083d53b7e79852fd03a82f2ea85d06c5bd2726a91d0

Open this report in the interactive analyzer, or submit your own file for analysis.