PDF malware analysis — malicious · 6ef34f6323cca13f

MALICIOUS

PDF

53.8 KB Created: 2021-04-06 12:49:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-11

MD5: b57208004ba61e014a453d346e2e95f3 SHA-1: 51fc273f7644ad3510db562e76f682b984b5a220 SHA-256: 6ef34f6323cca13f7d428266db1bc154dbcc5c438d15fca97778b00995776804

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded links and a lure related to "free Robux" and game hacks, specifically pointing to 'enigmagenerator.com'. This strongly suggests a phishing or scam attempt designed to trick users into visiting a potentially malicious website. While no scripts were directly extracted, the PDF structure and embedded URIs are indicative of a social engineering attack.

Machine Learning

Nyx PDF Classifier malicious score 0.8413

Heuristics 4

PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://www.eurosan1.ba/images/el-mejore-hack-de-roblox-marzo.pdfIn PDF document text
- https://www.fenews.co.uk/images/free-robux-codes-on-android-2021-no-human-verification.pdfIn PDF document text
- https://www.academiaanticorrupcion.org/images/roblox-survive-and-kill-the-killers-in-area-51-free.pdfIn PDF document text
- http://rosadent.com/images/new-roblox-hack-exploit-for-murder-mystery-2.pdfIn PDF document text
- http://nod74.ru/images/free-candy-roblox-script.pdfIn PDF document text
- https://www.manmed.info:443/images/free-cute-royale-high-outfits-roblox.pdfIn PDF document text
- http://legitame.org/images/free-robux-credit-card.pdfIn PDF document text
- https://www.utalii.ac.ke/images/roblox-dungeon-qeust-free-carries.pdfIn PDF document text
- http://fairwaygolftravel.co.uk/images/free-robux-codes-wiki-fandom.pdfIn PDF document text
- http://www.it-ro.it/images/how-to-get-free-robux-promo-codes-2021-august.pdfIn PDF document text
- https://asesoriamss.com/images/how-to-get-the-antine-villa-roblox-free.pdfIn PDF document text
- http://bkd1.balikpapan.go.id/images/roblox-robux-hack-2021-no-download.pdfIn PDF document text
- http://www.exikom.com.ua/images/robux-hack-tool-no-download.pdfIn PDF document text
- http://salon-vyshyvanka.com/images/hack-para-roblox-pet-simulator.pdfIn PDF document text
- http://eltisstudio.sk/images/15-robux-free.pdfIn PDF document text
- http://pizzeria-rosso.pl/images/free-robux-roblox-badge.pdfIn PDF document text
- http://www.sanjosedeminas.gob.ec/images/free-roblox-gift-card-codes-septemer-28-2021.pdfIn PDF document text
- http://pa-tanjungselor.go.id/images/como-coneguir-robux-gratis-roblox-pc-sin-hacks.pdfIn PDF document text
- https://javisintlmedia.com/images/roblox-cheat-engine-scripts-2021.pdfIn PDF document text
- http://global-tech-security.be/images/fake-robux-generator-for-free.pdfIn PDF document text
- http://gods-own.org/images/dragon-ball-super-2-roblox-hack.pdfIn PDF document text
- https://www.albisser.ch/images/roblox-elemental-battleground-hack-script.pdfIn PDF document text
- http://forsazh-51.ru/images/free-private-servers-roblox.pdfIn PDF document text
- http://pia2000.net/images/free-1-robux-a-day.pdfIn PDF document text
- http://aeroclub-kaernten.at/images/how-to-get-roblox-items-for-free-2021.pdfIn PDF document text
- http://www.eurologistiki.gr/images/hack-para-tener-robux-infinitos.pdfIn PDF document text
- http://bkd1.balikpapan.go.id/images/free-exploits-for-roblox-2021.pdfIn PDF document text
- http://www.awakeningtruth.org/images/a-hack-to-ban-people-free-on-roblox.pdfIn PDF document text
- https://tokunfome.com.br/images/get-free-roblox-private-servers.pdfIn PDF document text
- http://origamiperu.com/images/free-roblox-andoid-robux-hac.pdfIn PDF document text
- http://biccairo.com/images/natevang-hacks-roblox.pdfIn PDF document text
- http://petarda.hu/images/is-it-actually-possible-to-get-free-robux.pdfIn PDF document text
- http://fcic.edu.ph/images/how-get-free-robux-with-codes.pdfIn PDF document text
- https://jdlgroup.ca/images/roblox-vehicle-simulator-hacks.pdfIn PDF document text
- http://pgk-polaniec.pl/images/free-obc-roblox-accounts-2021.pdfIn PDF document text
- https://proviant.kz/images/tix-hack-roblox-cheat-engine.pdfIn PDF document text
- https://ambarevleri.com/images/best-free-roam-roblox-games.pdfIn PDF document text
- http://www.thecoffeebaron.co.za/images/free-acc-on-roblox-with-rbx-and-bc.pdfIn PDF document text
- http://subarulegacy.com/images/hack-roblox-game-ability.pdfIn PDF document text
- https://www.air-shop.cz/images/how-to-get-a-private-server-in-roblox-for-free.pdfIn PDF document text
- https://www.millatgears.com/images/yt-roblox-free-robux.pdfIn PDF document text
- http://drentklubben.se/images/illegal-roblox-hacks.pdfIn PDF document text
- https://www.yewtreealpacas.co.uk/images/android-fast-roblox-robux-hack.pdfIn PDF document text
- http://halitbayramoglu.com.tr/images/free-tv-series-roblox-shirt.pdfIn PDF document text
- http://finalstand.org/images/free-robux-2021-no-waiting-instant-no-inspect.pdfIn PDF document text
- http://italyfixer.com/images/roblox-executor-download-virus-free.pdfIn PDF document text
- http://www.guidaturisticaverona.it/images/roblox-apocalypse-rising-hack-download.pdfIn PDF document text
- http://abst-brandschutztechnik.com/images/free-level-7-executor-roblox-2021.pdfIn PDF document text
- https://www.mrsz.ir/images/como-hackear-ordenador-en-roblox-cuentas.pdfIn PDF document text
+16 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000070a3.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x70A3	26944 bytes
SHA-256: `a27ea39323c8e48cb1c3c9500f39411db6cd017dcb710713a0a1742a9def6d5d`
`font_01_sfnt_off0000acb1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xACB1	18920 bytes
SHA-256: `205a7a26281dfcddd7bfebe40970e0a7717631f43e68cf3664af0bdcd6e937c0`

Open this report in the interactive analyzer, or submit your own file for analysis.