Malicious PDF — malware analysis report

Static analysis result for SHA-256 829ede309e654a75…

MALICIOUS

PDF

53.0 KB Created: 2021-04-06 12:37:21 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-26
MD5: c043c9c0f4fd2f529c5659e9e65ff8a3 SHA-1: 244179ec11d05bb88bffc6aa871f0ae669455235 SHA-256: 829ede309e654a753acd0b674c5e1a83b01862ade1781dd443961dbd5e12521a
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple heuristics indicating it is a lure for game hacks, specifically targeting Robux. The embedded URL and document body text directly point to a malicious website promising game exploits. This suggests the document's primary purpose is to trick users into visiting a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8721

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://www.sanjosedeminas.gob.ec/images/how-to-change-your-name-on-roblox-with-cheat-engine.pdfIn PDF document text
    • http://erntefest2016.de/images/robloxcom-free-kkk-k.pdfIn PDF document text
    • http://www.gravel.ru/images/roblox-free-robux-codes.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/free-headphones-roblox-catalog.pdfIn PDF document text
    • http://riccardodurso.it/images/how-to-hack-into-roblox-acc.pdfIn PDF document text
    • https://invertsports.com/images/roblox-cheat-engine-online.pdfIn PDF document text
    • http://shootawayproduction.com/images/how-to-get-free-robux-super-easy-and-fast.pdfIn PDF document text
    • http://fccsms.com/images/synapses-hack-roblox.pdfIn PDF document text
    • http://www.mikramarine.gr/images/cheat-codes-for-roblox-2021.pdfIn PDF document text
    • http://portal.crfsp.org.br/images/redline-roblox-hack-2021.pdfIn PDF document text
    • http://shinarb.by/images/robux-and-tix-hack-2021.pdfIn PDF document text
    • http://racunari.in.rs/images/earn-free-robux-legit.pdfIn PDF document text
    • https://newenglandafs.com/images/hspart-imahsimp-yhsbatch1p-pastebin-free-robuxtype-batch1q20212021shq.pdfIn PDF document text
    • http://nikabio.com/images/free-roblox-gift-card-number.pdfIn PDF document text
    • http://hindicenter.com/images/bc-roblox-hack.pdfIn PDF document text
    • http://kulturhusbabberich.nl/images/roblox-hack-stats.pdfIn PDF document text
    • http://condit-pack.com/images/trickempire-xyz-free-robux.pdfIn PDF document text
    • http://posterprintshop.nl/images/free-rich-roblox-accounts-passwords.pdfIn PDF document text
    • http://cmme.it/images/treasure-hunt-roblox-hacks.pdfIn PDF document text
    • http://seniornetwanganui.org.nz/images/press-one-button-to-get-free-robux.pdfIn PDF document text
    • http://consultinggirona.es/images/zephplayz-free-robux-website.pdfIn PDF document text
    • https://www.brainpads.com/images/hacks-for-arsenal-roblox.pdfIn PDF document text
    • https://www.utalii.ac.ke/images/free-halloween-stuff-roblox.pdfIn PDF document text
    • http://www.oberberger.it/images/a-code-to-get-free-robux.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/free-robloxs-makeup.pdfIn PDF document text
    • http://itbits.ie/images/hack-to-find-people-ingame-in-roblox-cheat.pdfIn PDF document text
    • https://www.europap.cz/images/how-to-hack-builders-club-on-roblox.pdfIn PDF document text
    • http://brokermortgages.com/images/cheat-roblox-laxify.pdfIn PDF document text
    • http://www.arredifunebri.com/images/free-robux-money-codes-2021-july.pdfIn PDF document text
    • http://malichy.pl/images/roblox-how-to-activate-hack-gui-script.pdfIn PDF document text
    • http://behsanroshd.com/images/roblox-wizard-life-hack-site-v3rmillionnet.pdfIn PDF document text
    • https://kunstmalen.ch/images/best-free-building-games-in-roblox.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/best-free-roblox-exploits-2021.pdfIn PDF document text
    • http://techmobil.pl/images/how-to-hack-a-account-on-roblox-2021-no-logo.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/how-to-get-free-robux-using-promo-codes.pdfIn PDF document text
    • http://krymtorg-r.ru/images/chronosploit-roblox-hack.pdfIn PDF document text
    • https://sanjoseelectricians.net/images/free-robux-real-glitch.pdfIn PDF document text
    • https://ai-appenzell.ch/images/how-to-get-free-roblox-skins.pdfIn PDF document text
    • http://briankellyforcongress.com/images/roblox-robux-hack-walkthrough.pdfIn PDF document text
    • http://www.comitatoiseo.org/images/roblox-april-fools-hack-2021.pdfIn PDF document text
    • http://pandaplast.com/images/how-to-get-free-money-on-adopt-me-roblox.pdfIn PDF document text
    • https://europainstitut.hu/images/free-cloths-roblox-codes.pdfIn PDF document text
    • http://lakomat.by/images/free-robux-restraunt-tycoon.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/games-that-give-free-robux-2021.pdfIn PDF document text
    • https://www.osoc.com/images/roblox-free-red-valk.pdfIn PDF document text
    • https://www.audev.com/images/hacking-esp-roblox.pdfIn PDF document text
    • http://eleveurs-autrement.fr/images/how-to-get-roblox-accessories-for-free.pdfIn PDF document text
    • http://sscclc.edu.ec/images/how-to-hack-a-vip-server-on-roblox.pdfIn PDF document text
    • http://papec.ir/images/roblox-pizza-place-cheats.pdfIn PDF document text
    +11 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006f7b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6F7B 25856 bytes
SHA-256: c69bbd97ed99040b47fbc47c6d3495656b61d7416e913b060090eae89ac8b44a
font_01_sfnt_off0000ab5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAB5A 18304 bytes
SHA-256: b6f74646058eb04292a0c1924ab9d6ca3da19d2c4ccf32dd0c57f88fa55da0ff