Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f080914ea3136f1…

MALICIOUS

PDF

46.6 KB Created: 2021-04-09 02:12:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: af347f3c97b2f18bf85f09be5a575a5f SHA-1: 0c379a078c19636516a00374f21d6568b09f0c4c SHA-256: 6f080914ea3136f16a1b268a4a83236669b076f438396314aa9e2263c5a67f20
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous URLs pointing to sites offering game hacks and free Robux, indicating a lure for users to download malicious content. The heuristic firings, including ML_NYX_PDF_MALICIOUS and SE_SECURITY_BYPASS, strongly suggest malicious intent. The document body and embedded URLs suggest the primary goal is to trick users into downloading a second-stage payload, likely disguised as a game hack or exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 4

  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gaminggenerator.org/app/431946152/hack-robux-youtube-game-hack
    • http://reclaimcottage.co.uk/images/how-to-hack-roblox-usesing-python.pdf
    • http://ferienhaus-summt.de/images/donwload-roblox-free-on-chrome.pdf
    • http://jenne-technik.de/images/roblox-one-piece-millenium-stats-hack-script.pdf
    • http://arhi-z.ru/images/vechil-simulator-money-hack-roblox.pdf
    • http://keepcasscountybeautiful.com/images/www-robux-hacker-co.pdf
    • http://stomatolog-choszczno.pl/images/roblox-jailbreak-hack-script-pastebin.pdf
    • http://www.hhls.com.au/images/how-to-get-free-admin-on-roblox-pastebin.pdf
    • http://fiur-malermeister.de/images/earn-robux-today-free.pdf
    • http://fwv-vallendar.de/images/free-roblox-promotion-codes.pdf
    • http://ines.co.rs/images/the-easiest-way-to-get-free-robux.pdf
    • https://ceiprevellodetoro.org/images/free-roblox-robux-generator-2021.pdf
    • http://pechativmoskve.ru/images/roblox-vehicle-simulator-money-hack-deutsch-2021.pdf
    • http://www.actae.gr/images/roblox-cheat-engine-robux-hack-2021.pdf
    • http://mnp-realty.ru/images/roblox-free-no-login.pdf
    • https://masseymotorcars.com/images/free-vector-roblox-logo.pdf
    • http://www.bzconstructionservices.com/images/free-roblox-generator.pdf
    • http://sfsbm.org/images/hack-roblox-btools-2021.pdf
    • http://jasperfirstumc.com/images/roblox-speed-hacks-that-u-can-type-in-chat.pdf
    • http://inextpresident.com/images/easy-way-to-get-free-robux.pdf
    • http://apx-centre.ru/images/roblox-free-ninja-mask.pdf
    • http://ferienhaus-summt.de/images/donwload-roblox-free-on-
    • http://arhi-z.ru/images/vechil-simulator-money-hack-
    • http://stomatolog-choszczno.pl/images/roblox-jailbreak-hack-
    • http://fiur-malermeister.de/images/earn-
    • http://ines.co.rs/images/the-easiest-way-to-get-free-
    • http://pechativmoskve.ru/images/roblox-vehicle-simulator-
    • http://mnp-realty.ru/images/roblox-free-
    • http://www.bzconstructionservices.com/images/free-roblox-
    • http://jasperfirstumc.com/images/roblox-speed-hacks-that-u-can-type-in-
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00005c1f.bin
bd8079e302388af4f7a8b7b8cd6248dd86acfa83238df5cf8f4f5d8045822443
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5C1F 25152 bytes
font_01_sfnt_off000095bd.bin
7ec66b99b84e32fa2edd048725db551aa3ab6ab24d740b9071aff48b885c73e9
pdf-font-stream PDF embedded font (sfnt) at offset 0x95BD 17728 bytes