PDF malware analysis — malicious · 7782505ac2a48c0b

MALICIOUS

PDF

243.1 KB Created: 2021-04-05 11:54:31 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-13

MD5: 298560c100fb08217d97c72aba9c69b8 SHA-1: 4f6de0393f60abb9f6571fa61bb94bef2c2b69ca SHA-256: 7782505ac2a48c0b7c846c9836705b169ccb2205dee98745d4dbc5e54f4e43b5

72 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a specific signature indicating a phishing attempt related to Roblox. The embedded URL and document body content further support a lure for free virtual currency, likely leading to a download of a second-stage payload. No scripts were extracted, but the PDF structure and external URI point to a phishing campaign.

Machine Learning

Nyx PDF Classifier clean score 0.2248

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/free-robux-no-verification-2021-ios PDF link annotation
- https://gimnaziya6.kz/images/2021-roblox-accounts-for-free.pdfIn PDF document text
- http://axiapublishers.com/images/roblox-medieval-hood-of-mystery-get-free.pdfIn PDF document text
- http://www.nielsen2u.dk/images/free-roblox-pastebin.pdfIn PDF document text
- http://schrichte.de/images/asshurt-roblox-free-download.pdfIn PDF document text
- http://reggieslockandkey.com/images/daniel-newhard-roblox-hack.pdfIn PDF document text
- https://uofk.edu/images/games-on-roblox-where-you-win-a-free-clothes.pdfIn PDF document text
- https://www.cosmosdawn.net/images/hack-tool-robux.pdfIn PDF document text
- http://itbits.ie/images/free-roblox-computer-games.pdfIn PDF document text
- http://ff-obertraun.at/images/how-to-hack-roblox-prison-life-on-android-ipad-2021.pdfIn PDF document text
- https://www.manisoft.ir/images/roblox-vouchers-free.pdfIn PDF document text
- http://plantas.net/images/how-to-hack-on-roblox-jail-breaker.pdfIn PDF document text
- http://addair.co.uk/images/roblox-mad-city-hack-2021.pdfIn PDF document text
- http://kundentest.de/images/hacks-para-roblox-bee-swarm-simulator.pdfIn PDF document text
- http://hydroconseil.net/images/robux-hack-no-human-verification-or-download.pdfIn PDF document text
- http://sbm-nn.ru/images/how-to-use-roblox-loki-hacks.pdfIn PDF document text
- http://hemmet-strand.dk/images/robux-website-hack.pdfIn PDF document text
- https://yarburservices.ru/images/free-script-injector-for-roblox.pdfIn PDF document text
- http://www.notaioricci.it/images/alpha-hack-roblox.pdfIn PDF document text
- http://seniornetwanganui.org.nz/images/breaking-point-tips-and-tricks-and-hacks-roblox.pdfIn PDF document text
- http://www.fanciullovito.it/images/site-to-have-free-robux.pdfIn PDF document text
- http://arch-centr.ru/images/hack-roblox-admin-dl.pdfIn PDF document text
- http://briankellyforcongress.com/images/exploit-roblox-hack-download.pdfIn PDF document text
- http://unifieo.br/images/win-robux-for-free.pdfIn PDF document text
- http://www.boic.nl/images/rbx-exchange-free-robux.pdfIn PDF document text
- http://panaceafamilymedicine.com/images/cheats-para-roblox.pdfIn PDF document text
- https://www.academiaanticorrupcion.org/images/roblox-money-cheat-codes-2021.pdfIn PDF document text
- http://jaeger-bauplanung.de/images/how-to-make-a-free-shirt-in-roblox.pdfIn PDF document text
- https://ai-appenzell.ch/images/redeem-code-roblox-free-robux-2021.pdfIn PDF document text
- http://goosesscuba.com/images/free-robux-no-human-verification-no-download-no-survey.pdfIn PDF document text
- http://jkcoaching.nl/images/free-robux-content-deleted.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00037463.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x37463	21448 bytes
SHA-256: `9a5c4856dc4e24960f9af25df2d20cec1d28400be7d08033929806819d4a7e05`
`font_01_sfnt_off0003a366.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3A366	18888 bytes
SHA-256: `8d6ac1d7c7f077885915139d26d7afffce10c0727015c186056f1b54891fdaa7`

Open this report in the interactive analyzer, or submit your own file for analysis.