PDF malware analysis — malicious · 7e2c0095d59e3ea3

MALICIOUS

PDF

242.7 KB Created: 2021-04-05 00:33:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-26

MD5: 90ed0340c59f14cfb9d338cf068a0fb6 SHA-1: ab470ab04be38ae9c95f0b61cb5ab962e931faca SHA-256: 7e2c0095d59e3ea3144e1a2a06376d89f63767f7139a91aa0bcd7ad6e50ddc69

72 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document detected as phishing by ClamAV. It contains multiple embedded URLs, with one prominent URL pointing to a site offering free Robux, a virtual currency for the Roblox game. The document body, though heavily obfuscated, contains text related to obtaining free Robux. The presence of numerous similar URLs suggests a phishing campaign aimed at Roblox players.

Machine Learning

Nyx PDF Classifier suspicious score 0.2693

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/hw-to-gget-free-robux PDF link annotation
- http://logisticgroup.co/images/2021-robux-free.pdfIn PDF document text
- http://seniorenverband-brh-nds.de/images/get-free-things-on-roblox.pdfIn PDF document text
- http://jijel.info/images/can-you-hack-someone-roblox.pdfIn PDF document text
- http://apostolosandreaslemesou.com/images/esp-xray-roblox-hacks.pdfIn PDF document text
- http://jugendfeuerwehr-scheinfeld.de/images/hacking-game-roblox.pdfIn PDF document text
- https://www.beaufortcollege.ie/images/how-to-hack-roblox-no-download-2021.pdfIn PDF document text
- http://gops.pruszczgdanski.pl/images/free-shirt-design-roblox.pdfIn PDF document text
- http://escolaarboc.cat/images/free-download-roblox-mod-apk.pdfIn PDF document text
- http://www.brtes.com/images/roblox-elemental-wars-hack.pdfIn PDF document text
- http://moto98.com/images/top-free-rthro-on-roblox.pdfIn PDF document text
- https://www.hotschool.com.au/images/the-fastest-way-to-get-free-robux.pdfIn PDF document text
- http://finalstand.org/images/roblox-all-gamepasses-for-free-script.pdfIn PDF document text
- http://gitagasht.com/images/roblox-cheat-engine-bypass-february-2021.pdfIn PDF document text
- http://businessfit.com/images/how-to-get-free-robux-with-cheat-engine.pdfIn PDF document text
- https://schaefer-rechtsanwaelte.com/images/play-roblox-com-free.pdfIn PDF document text
- http://ferienwohnung-walker.de/images/roblox-apoc-kill-hack.pdfIn PDF document text
- http://tecnodue.com/images/cheat-engine-fighters-beta-how-to-level-up-fast-roblox.pdfIn PDF document text
- http://erntefest2016.de/images/free-coins-for-roblox.pdfIn PDF document text
- https://www.wildpark-johannismuehle.de/images/case-clicker-2021-hack-roblox.pdfIn PDF document text
- https://inscastellar.cat/images/how-to-hack-roblox-with-hydra.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0003713b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3713B	23340 bytes
SHA-256: `6a9cf3b1a5035f7704214fc4b36ca9e5a852629f0b14fe6599cde18a00e89fe6`
`font_01_sfnt_off0003a5e0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3A5E0	17800 bytes
SHA-256: `57432d57e60313e59c26c64e14751f96684711c9b9a75f3e20c4d4210b324d3f`

Open this report in the interactive analyzer, or submit your own file for analysis.