Malicious PDF — malware analysis report

Static analysis result for SHA-256 726136661f6dc460…

MALICIOUS

PDF

245.3 KB Created: 2021-04-04 09:37:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-06-17
MD5: dfb4ea7ce05358ea9aac358831b1dd5a SHA-1: 61e481df8b8b1cb627e49deef293db7478843df1 SHA-256: 726136661f6dc4604b31ce759fc3dfa0996525293338bc0c5c7efaba7e819b1a
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a phishing signature related to Roblox. The document body and extracted URLs promote content about hacking Roblox, suggesting a phishing or scam lure. While no scripts were explicitly extracted, the PDF structure and embedded URIs indicate an attempt to redirect users to malicious websites.

Machine Learning

  • Nyx PDF Classifier clean score 0.1227

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-hack-roblox-prison-life-on-ipad PDF link annotation
    • http://ptts.pl/images/roblox-free-items.pdfIn PDF document text
    • http://intrasservices.com/images/free-vip-admin-commands-with-all-permissions-for-roblox.pdfIn PDF document text
    • https://masseymotorcars.com/images/prison-life-script-roblox-hack-pastebin.pdfIn PDF document text
    • http://belagrogen.by/images/roblox-hacks-robux-december-2021.pdfIn PDF document text
    • http://huananhai.net/images/free-roblox-no-verification.pdfIn PDF document text
    • http://cristalysoptic.com/images/did-roblox-get-hacked-in-2021.pdfIn PDF document text
    • http://sb2m.com.br/images/roblox-donloaden-free.pdfIn PDF document text
    • https://www.ausecus.com/images/call-of-robloxia-5-roblox-at-war-cheats.pdfIn PDF document text
    • http://sandra-masemann.de/images/how-to-kick-someone-on-roblox-using-cheat-engine.pdfIn PDF document text
    • http://cdescolapios.org/images/cheat-engine-scripts-roblox.pdfIn PDF document text
    • https://bgescc.com/images/how-to-hack-into-roblox-accounts-using-a-cookie-editor.pdfIn PDF document text
    • http://greasley.online/images/free-roblox-game-card.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/how-to-get-robux-free-roblox-glitch-2021-savagery.pdfIn PDF document text
    • http://www.actae.gr/images/roblox-hack-robux-ohne-handynummer.pdfIn PDF document text
    • http://interpretation-dessins-enfants.net/images/free-robux-code-generator-no-download.pdfIn PDF document text
    • http://halitbayramoglu.com.tr/images/how-to-get-free-robux-on-ipad.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/how-to-get-free-robux-gift-cards-no-human-verification.pdfIn PDF document text
    • https://www.utalii.ac.ke/images/how-to-get-robux-and-tix-for-free-on-roblox.pdfIn PDF document text
    • http://the-specials.ch/images/brdarski-roblox-inspect-element-hack.pdfIn PDF document text
    • http://wcasrock.org/images/hacking-2021-members-into-my-group-roblox.pdfIn PDF document text
    • http://gods-own.org/images/free-time-on-roblox.pdfIn PDF document text
    • https://asesoriamss.com/images/how-to-hack-alone-batle-royale-with-roblox.pdfIn PDF document text
    • http://www.occquimica.com.br/images/free-robux-hack-code-2021.pdfIn PDF document text
    • https://www.u-pin-it.com/images/roblox-mad-city-free-cars.pdfIn PDF document text
    • http://kancelaria-legnica.eu/images/hacks-for-roblox-injectors.pdfIn PDF document text
    • https://sdg-trade.com/images/roblox-server-free-app.pdfIn PDF document text
    • https://www.mrsz.ir/images/roblox-free-noob-skin.pdfIn PDF document text
    • http://aiyta.com/images/roblox-vietnam-2021-hacks.pdfIn PDF document text
    • https://kimolos-link.gr/images/veil-roblox-exploit-free-download.pdfIn PDF document text
    • https://www.cfdcnv.com/images/cheat-engine-v3-roblox-download.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000380a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x380A1 19636 bytes
SHA-256: 09cd76b86c2af46ba2c24676af59d238860250f739f81369d38e267df92f74ae
font_01_sfnt_off0003aa2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3AA2F 18856 bytes
SHA-256: c80af918f99133bbe43927a822e88e8248ca893adc1168f6ca3bdb6bb53e910f

Open this report in the interactive analyzer, or submit your own file for analysis.