Malicious PDF — malware analysis report

Static analysis result for SHA-256 88529576199f5f91…

MALICIOUS

PDF

38.4 KB Created: 2021-04-03 15:59:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 32fe740cc24119ebc4aa6b31ddbd1b00 SHA-1: 19526b5b855f9b3f05b6c4d6a007520db1b0b38a SHA-256: 88529576199f5f91b5d57b7f615e6f1c13e84ddc50445ec631c3d79277324bd8
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to websites that promise game hacks and free virtual currency, indicative of a scam or phishing attempt. The heuristic firings strongly suggest a link farm designed to lure users to these sites. While no scripts were extracted, the document body and embedded URLs point towards a social engineering tactic to drive traffic to malicious or scam-related content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9569

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/hacked-roblox-faces PDF link annotation
    • https://www.cosmosdawn.net/images/survey-for-free-robux.pdfIn PDF document text
    • http://dos.most.gov.la/images/noob-vs-pro-vs-hacker-roblox-bloxburg-build.pdfIn PDF document text
    • https://www.romedia.gr/images/roblox-saob-hack.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/como-descargarse-hacks-en-roblox-jailbreak-agosto-2021.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/how-to-have-free-robux-on-roblox-2021.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/robux-generator-hack-no-survey.pdfIn PDF document text
    • http://nosocomium.rv.ua/images/how-to-bypass-roblox-anticheat.pdfIn PDF document text
    • https://www.lavigny.ch/images/hacking-roblox-trhough-coockies.pdfIn PDF document text
    • https://www.tsdb.com.au/images/roblox-cheats-for-android.pdfIn PDF document text
    • https://www.albisser.ch/images/hack-para-cbro-roblox.pdfIn PDF document text
    • http://www.evaplast.by/images/best-hacking-software-for-roblox.pdfIn PDF document text
    • http://domaizdereva24.ru/images/jjsploit-v2-roblox-hack.pdfIn PDF document text
    • http://nevesomost.by/images/free-admin-2021-roblox-game.pdfIn PDF document text
    • https://www.tsdb.com.au/images/free-remy-roblox-id.pdfIn PDF document text
    • http://www.eurosan1.ba/images/roblox-red-boy-hack.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/free-robux-2021-august.pdfIn PDF document text
    • http://www.maakherumusic.net/images/paginas-de-hack-para-roblox.pdfIn PDF document text
    • https://www.hbproducts.dk/images/free-roblox-intro-maker.pdfIn PDF document text
    • https://www.tsdb.com.au/images/free-robux-game-guardian.pdfIn PDF document text
    • https://estalagemmonteverde.com.br/images/adopt-me-roblox-hack-money-free.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/easy-robux-today-hack-no-human-verification.pdfIn PDF document text
    • https://www.iadh.bi/images/how-to-get-free-robux-2021-savage.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/join-this-roblox-group-for-free-robux.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/hacks-to-steal-robux-sign-up.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/roblox-hack-apk-download-android-1.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/roblox-script-hack-gui.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/roblox-how-to-check-a-games-anti-cheat.pdfIn PDF document text
    • http://www.hawler.in/images/best-free-roblox-hacks.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/elysian-roblox-hack.pdfIn PDF document text
    • https://www.lavigny.ch/images/john-doe-hacked-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off00004044.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004044.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4044 23008 bytes
SHA-256: 55ac5b6ba012547d58d74119a8fab9ec231a64a081989b4a2181a935b980a84f
font_01_sfnt_off000073b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x73B4 17928 bytes
SHA-256: 09a005768c45f2ba81cfe242d26b59dbdf778d73c374ae9f57f3695b582f3000