Malicious PDF — malware analysis report

Static analysis result for SHA-256 7eb1e6c618308335…

MALICIOUS

PDF

33.3 KB Created: 2021-04-03 20:41:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-24
MD5: f7a3a560cfbb77934b3c85edbb9ea8f4 SHA-1: 579271f06796881d6475f580e81d41137b9386d4 SHA-256: 7eb1e6c618308335d04be2fd8456e1d8bf3b998dc1148283dad10fb828ac6e9a
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous links and text related to 'game hacks' and 'free Robux', indicating a scam or phishing attempt. The heuristic firings, particularly 'PDF_GAME_HACK_SEO_LINK_FARM', strongly suggest the document's purpose is to direct users to scam websites. The ML classifier also flagged the PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-hack-roblox-for-unlimited-robux PDF link annotation
    • http://escolaarboc.cat/images/roblox-free-robux-codes-2021.pdf%0AIn PDF document text
    • http://sscclc.edu.ec/images/roblox-free-download-xbox-one.pdf%0AIn PDF document text
    • https://www.ncscolour.no/images/free-robux-gift-card-codes-2021.pdf%0AIn PDF document text
    • https://www.ghknights.org/images/free-roblox-money-generator.pdf%0AIn PDF document text
    • http://uctovnictvosnv.sk/images/free-verify-email-roblox.pdf%0AIn PDF document text
    • http://www.fanciullovito.it/images/fun-and-free-games-on-roblox.pdf%0AIn PDF document text
    • https://www.udivadlahotel.cz/images/how-to-get-free-robux-on-pc-no-human-verification.pdf%0AIn PDF document text
    • https://estalagemmonteverde.com.br/images/how-to-get-furniture-for-free-on-roblox-highschool.pdf%0AIn PDF document text
    • http://www.lionel-seppoloni.fr/images/get-free-robux-no-human-verification-or-download.pdf%0AIn PDF document text
    • http://www.jureclomas.com.ar/images/free-robux-using-eval.pdf%0AIn PDF document text
    • http://svp-steinmaur.ch/images/installer-script-roblox-hack-gui.pdf%0AIn PDF document text
    • https://www.cosmosdawn.net/images/roblox-jailbroken-hack.pdf%0AIn PDF document text
    • http://uctovnictvosnv.sk/images/roblox-vampire-hunters-2-cheats.pdf%0AIn PDF document text
    • https://esl.ipb.ac.id/images/free-games-to-play-roblox.pdf%0AIn PDF document text
    • http://ns1.radiofacil.net/images/roblox-cbro-cheat-spots.pdf%0AIn PDF document text
    • http://www.torvet11.dk/images/roblox-apk-hack-mod.pdf%0AIn PDF document text
    • https://www.dierenartsberghman.be/images/free-roblox-card-codes-2021-no-survey.pdf%0AIn PDF document text
    • http://www.mjclautrec.fr/images/game-guardian-hack-roblox.pdf%0AIn PDF document text
    • http://www.adravietnam.org/images/como-instalar-hacks-para-roblox.pdf%0AIn PDF document text
    • http://www.ntc.edu.za/images/free-lagless-roblox-recorder.pdf%0AIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/fps-hacks-roblox-aimbot-how-to-activate-ambot.pdf%0AIn PDF document text
    • https://corbo.ru/images/pastebin-roblox-robux-hack-2021.pdf%0AIn PDF document text
    • https://www.cnte.org.br/images/roblox-muscle-simulator-cheat-codes.pdf%0AIn PDF document text
    • http://sscclc.edu.ec/images/guy-cheats-on-irl-girlfriend-with-roblox-girlfriend.pdf%0AIn PDF document text
    • http://www.web.stc-part.co.th/images/free-robux-hack-real.pdf%0AIn PDF document text
    • https://fkg.usu.ac.id/images/free-robux-elizabeth-songs.pdf%0AIn PDF document text
    • http://uptodate.az/images/how-to-get-free-money-in-restaurant-tycoon-roblox.pdf%0AIn PDF document text
    • https://www.porthos.it/images/roblox-prison-life-how-to-hacks-jjsploi.pdf%0AIn PDF document text
    • http://bkd1.balikpapan.go.id/images/roblox-wizard-life-galleons-hack.pdf%0AIn PDF document text
    • http://www.fluidtech.hu/images/birmungham-airport-roblox-free.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00003483.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003483.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3483 19136 bytes
SHA-256: 83db76462d7cab207bf5790386acd54b3d6814c6b7ce30f3ce6fe58d67bf2f17
font_01_sfnt_off00005c91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5C91 19028 bytes
SHA-256: 84ca575c5635869453abfd305970a9389449712f27e204a85e2458d2b8fcb84a