Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f66a4cd9dbaec8d…

MALICIOUS

PDF

52.2 KB Created: 2021-04-06 13:25:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: b825f38dfc9449ea938751ba5652e73c SHA-1: 0d9fcd7327259b2d287aa83da0675782634c8d74 SHA-256: 6f66a4cd9dbaec8d7ec92b8f863521f623cf53bd672869533e3b72be7bd22fb5
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains multiple links and a call-to-action lure, directing users to websites offering game hacks and cheats for Roblox. This is a common social-engineering tactic to trick users into downloading malicious files or visiting compromised sites. The ML classifier also flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8896

Heuristics 5

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • https://osk-sibir.ru/images/free-robux-by-bananaman.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/view-noclip-hack-roblox.pdfIn PDF document text
    • http://w-i-r.de/images/roblox-free-t-shirt-2021.pdfIn PDF document text
    • http://webstan.be/images/fre-click-tp-roblox-script.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-robux-now-today.pdfIn PDF document text
    • https://www.cpnf.ch/images/donde-entrar-para-ser-hacker-en-roblox.pdfIn PDF document text
    • https://www.colditex.com/images/free-robux-lebansay.pdfIn PDF document text
    • http://eddegrootassurantien.nl/images/cartoon-animation-free-roblox.pdfIn PDF document text
    • https://www.cnte.org.br/images/promo-codes-hack-on-roblox-gives-free-robux-2021.pdfIn PDF document text
    • http://centuriatus.com/images/2021-robux-on-robux-free.pdfIn PDF document text
    • https://seedungo.com/images/roblox-events-free-robux.pdfIn PDF document text
    • http://www.lionel-seppoloni.fr/images/free-roblox-bloxburg.pdfIn PDF document text
    • http://interpretation-dessins-enfants.net/images/good-watch-dogs-hacking-games-on-roblox.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/roblox-cheat-engine-tutorial.pdfIn PDF document text
    • http://apostolosandreaslemesou.com/images/games-roblox-for-free.pdfIn PDF document text
    • http://smart-pro.co.uk/images/roblox-free-robux-hack-no-survey-no-download-2021.pdfIn PDF document text
    • http://escolaarboc.cat/images/how-to-get-hacks-on-roblox-phantom-forces.pdfIn PDF document text
    • http://jdlrelocation.com/images/how-to-get-a-free-gravity-coil-in-all-roblox.pdfIn PDF document text
    • http://www.controverseinterapie.it/images/roblox-bone-break-cheat-engine.pdfIn PDF document text
    • http://adues.org/images/https-wwwrobloxcom-games-2021202196-freeubersummerrewards.pdfIn PDF document text
    • http://agrupamentoescolas-alfredo-da-silva.com/images/roblox-free-champion-shirt.pdfIn PDF document text
    • http://www.actae.gr/images/roblox-deadzone-hacks.pdfIn PDF document text
    • https://www.foodsafety.cz/images/ultimate-free-robux-generator.pdfIn PDF document text
    • https://www.appartamenticroazia24.com/images/free-money-adopt-me-roblox.pdfIn PDF document text
    • http://ivpr.net/images/minecraft-is-free-roblox.pdfIn PDF document text
    • http://cristalysoptic.com/images/free-roblox-cads.pdfIn PDF document text
    • http://interpretation-dessins-enfants.net/images/roblox-hack-robux-and-tix.pdfIn PDF document text
    • https://luminouswisdom.org/images/free-dominus-roblox-2021.pdfIn PDF document text
    • http://eau-petit-pont.com/images/how-to-get-a-hacked-account-on-roblox-back.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/roblox-working-robux-hack-2021.pdfIn PDF document text
    • http://www.fluidtech.hu/images/nilamyt-free-robux-socialblade.pdfIn PDF document text
    • http://shahriyarclimb.com/images/scaciati-mega-cheat-roblox-2021.pdfIn PDF document text
    • http://gc-sistemas.com.ar/images/roblox-jailbreak-speed-hack-codes.pdfIn PDF document text
    • http://lv-siegen.de/images/free-vip-shirt-roblox.pdfIn PDF document text
    • http://feuerwehr-rheinau.de/images/how-to-work-get-a-roblox-hack-gui-to-work.pdfIn PDF document text
    • http://iedarelief.us/images/robux-hack-no-verification-or-survey.pdfIn PDF document text
    • https://www.milewood.co.uk/images/roblox-dll-hacks-download.pdfIn PDF document text
    • https://piscinasmundoacuatico.com/images/forum-comment-cheat-sur-roblox.pdfIn PDF document text
    • http://www.playerzone.it/images/comment-avir-des-robux-sans-hack.pdfIn PDF document text
    • http://wireprod.net/images/free-robux-2021-download.pdfIn PDF document text
    • http://pourvosvacances.com/images/oneapprewards-roblox-hack.pdfIn PDF document text
    • http://global-tech-security.be/images/cheat-engine-money-hack-roblox.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/how-to-get-robux-for-free-without-human-verification-2021.pdfIn PDF document text
    • http://www.comitatoiseo.org/images/como-hackear-a-alguien-de-roblox-y-tener-robux-2021.pdfIn PDF document text
    • http://musical-arts.de/images/free-roblox-premium.pdfIn PDF document text
    • http://modlingua.com/images/roblox-infinite-jump-hack-download-2021.pdfIn PDF document text
    • http://ff-obertraun.at/images/roblox-pet-simulator-hack.pdfIn PDF document text
    • https://my-private-intendant.com/images/hacks-para-roblox-robux-gratis-2021.pdfIn PDF document text
    • https://www.iadh.bi/images/how-to-look-like-a-guest-in-roblox-for-free.pdfIn PDF document text
    +19 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000700a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x700A 25036 bytes
SHA-256: 955fe8202329634adb19b0548501dd1e9718f8a631eeaa10887c8ac4273810a1
font_01_sfnt_off0000a975.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA975 17840 bytes
SHA-256: 367ed4dbc622824e614491f82b2728139bf077b8226553dbead060bd8cfaefdb