Malicious PDF — malware analysis report

Static analysis result for SHA-256 8311a5ff0fd47e05…

MALICIOUS

PDF

33.7 KB Created: 2021-04-03 18:31:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-12
MD5: deecfba90ce53e7692ac7c107c65883a SHA-1: 54a732258411aac5a2cd44199e48dbafc39f5f00 SHA-256: 8311a5ff0fd47e05a3db3744263d3a326e0b3464d273b3cd70a5d711c792eec5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains a large number of URLs pointing to websites offering game hacks and exploits, specifically for Roblox. The heuristic firings indicate a 'game hack SEO link farm' and a malformed exploit stream, suggesting the document is designed to redirect users to malicious sites. While no scripts were extracted, the document body and heuristics strongly suggest a phishing or scam attempt to lure users into downloading potentially harmful files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 6

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
    A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/descargar-hacks-para-roblox-2021-con-fly PDF link annotation
    • http://www.eurosan1.ba/images/hacker-roblox-portable.pdf%0AIn PDF document text
    • http://www.copoint.co.uk/images/roblox-injectors-free.pdf%0AIn PDF document text
    • http://www.hawler.in/images/hack-for-all-games-roblox.pdf%0AIn PDF document text
    • https://www.lomrad.go.th/images/roblox-avatar-customize-free.pdf%0AIn PDF document text
    • https://verdensbarn.no/images/how-to-bypass-cheat-engine-on-roblox-2021.pdf%0AIn PDF document text
    • https://www.air-shop.cz/images/beyond-roblox-hack-scriptr.pdf%0AIn PDF document text
    • http://www.gadanie.lv/images/free-bc-robux.pdf%0AIn PDF document text
    • https://www.lavigny.ch/images/free-robux-site-no-survey.pdf%0AIn PDF document text
    • https://www.seeingindependence.org/images/how-to-get-a-free-car-in-bloxburg-roblox.pdf%0AIn PDF document text
    • http://www.ntc.edu.za/images/roblox-mad-paintball-2-hacks.pdf%0AIn PDF document text
    • http://ff-obertraun.at/images/hack-arsenal-roblox-2021.pdf%0AIn PDF document text
    • https://meltonschool.org/images/wwwfree-robuxcom-free-robux-now.pdf%0AIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/how-do-you-change-your-name-on-roblox-for-free.pdf%0AIn PDF document text
    • http://pa-tanjungselor.go.id/images/como-obtener-robux-hack.pdf%0AIn PDF document text
    • http://www.mikramarine.gr/images/hack-roblox-cs-go.pdf%0AIn PDF document text
    • http://www.inservis.cl/images/how-to-hack-int-a-friends-roblox-account.pdf%0AIn PDF document text
    • https://www.stkdb.cz/images/roblox-x-ray-hack.pdf%0AIn PDF document text
    • https://www.iadh.bi/images/code-for-roblox-hack-generator.pdf%0AIn PDF document text
    • http://www.ntc.edu.za/images/royalty-free-roblox-music.pdf%0AIn PDF document text
    • https://verdensbarn.no/images/get-roblox-app-for-free.pdf%0AIn PDF document text
    • https://www.lavigny.ch/images/hack-script-roblox-game.pdf%0AIn PDF document text
    • http://energotestcontrol.ru/images/free-robux-generator-august-2021.pdf%0AIn PDF document text
    • http://gops.pruszczgdanski.pl/images/free-catalog-items-roblox-2021-december.pdf%0AIn PDF document text
    • http://salantiskis.lt/images/cheat-for-roblox-super-speed-and-jump-hack.pdf%0AIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/hack-de-counter-blox-roblox-offensive.pdf%0AIn PDF document text
    • http://hemmet-strand.dk/images/free-safe-roblox-exploits.pdf%0AIn PDF document text
    • http://www.evaplast.by/images/win-2021-free-robux.pdf%0AIn PDF document text
    • http://salantiskis.lt/images/robux-redeem-card-hack.pdf%0AIn PDF document text
    • http://www.jureclomas.com.ar/images/roblox-alt-accounts-free.pdf%0AIn PDF document text
    • http://aeroclub-kaernten.at/images/how-to-get-free-robux-2021-january.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off000033ae.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33AE 19616 bytes
SHA-256: 3c9c03c30fd06ad7a5edfe47a9f38956339579b7a820805ed91e8c8266d10687
font_01_sfnt_off00005d42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D42 19264 bytes
SHA-256: 7b5c4986a573f534c5527aebe282a2ad907937bac052ea278136b1b57da7f966