Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b4f863b4513acbd…

MALICIOUS

PDF

64.2 KB Created: 2021-04-05 23:12:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 84e2baa34be4775d3d42429c2c565eaa SHA-1: 3b418b9914df8bdce1acfdd35ff4fb1a6c0c536f SHA-256: 8b4f863b4513acbd625819bdd66ea9083fe93abce8ce00bca9d651f676a6cf78
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The PDF document contains multiple embedded URLs and heuristics indicate it is malicious. The document body and heuristics suggest a lure related to 'Roblox Avatar Skins For Free' and a 'Click here to download' call-to-action. The 'SE_CLIPBOARD_COMMAND_LURE' heuristic indicates the document likely instructs the user to copy and paste content into a command-line interface, a common technique for executing malicious payloads. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6301

Heuristics 5

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-avatar-skins-for-free PDF link annotation
    • https://gafaseo.com/images/free-clothes-for-roblox-2021.pdfIn PDF document text
    • https://www.bmta.co.uk/images/diamond-hacker-roblox.pdfIn PDF document text
    • http://www.awakeningtruth.org/images/how-to-use-cheat-engine-with-roblox-games.pdfIn PDF document text
    • https://inscastellar.cat/images/roblox-demo-free-play.pdfIn PDF document text
    • http://wcasrock.org/images/extreme-injector-hack-roblox.pdfIn PDF document text
    • https://www.seeingindependence.org/images/roblox-prison-life-hacking-sex.pdfIn PDF document text
    • http://pdapanache.com/images/roblox-weight-lifting-simulator-cheat-codes.pdfIn PDF document text
    • http://www.thecoffeebaron.co.za/images/free-clothes-on-roblox-image.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/free-robux-2021-for-pc.pdfIn PDF document text
    • https://grovehilloutfitters.com/images/how-to-ban-or-kick-in-servers-roblox-hack-scrip.pdfIn PDF document text
    • http://www.homesweethome.pl/images/how-to-get-free-robux-for-no-money.pdfIn PDF document text
    • http://magistrinfo.ru/images/cheat-engine-roblox-bypass-2021.pdfIn PDF document text
    • http://kfz-service-etp.de/images/guuiddinfo-roblox-hack.pdfIn PDF document text
    • http://jaeger-bauplanung.de/images/robux-hack-revealed.pdfIn PDF document text
    • http://iluvlocalplaces.com/images/roblox-robux-cheat-engne-address.pdfIn PDF document text
    • http://forsazh-51.ru/images/free-robux-generator-that-really-works-that-works-right-away.pdfIn PDF document text
    • http://cosver.eu/images/how-to-hack-simon-says-on-roblox.pdfIn PDF document text
    • http://smart-pro.co.uk/images/robux-hack-million.pdfIn PDF document text
    • https://www.yewtreealpacas.co.uk/images/how-to-get-free-robux-hack-ipad.pdfIn PDF document text
    • http://www.danzamaniapergine.it/images/how-to-hack-stats-on-a-roblox-game.pdfIn PDF document text
    • http://ruksnaitis.com/images/roblox-robux-generator-2021-free-download-no-surveys.pdfIn PDF document text
    • https://www.tsdb.com.au/images/free-robux-laptop.pdfIn PDF document text
    • https://asesoriamss.com/images/230-robux-free.pdfIn PDF document text
    • http://addair.co.uk/images/roblox-hack-today.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/auto-clicker-on-roblox-for-free.pdfIn PDF document text
    • http://clubpure.org/images/roblox-hack-vehicle-simulator.pdfIn PDF document text
    • https://liftkos.com/images/roblox-notepad-hack.pdfIn PDF document text
    • http://nikabio.com/images/how-to-hack-roblox-prison-life-2021.pdfIn PDF document text
    • http://krymtorg-r.ru/images/hack-roblox-2021-descargar.pdfIn PDF document text
    • https://gaj.rs/images/roblox-catalof-20212021-for-free.pdfIn PDF document text
    • http://www.guidaturisticaverona.it/images/free-robux-download-ios.pdfIn PDF document text
    • https://www.ferienhausdirektkroatien.de/images/comment-hacker-roblox-prison-life.pdfIn PDF document text
    • https://pagadder.com/images/rbxboost-free-robux.pdfIn PDF document text
    • http://museumkk.ru/images/domino-crown-roblox-free.pdfIn PDF document text
    • http://apostolosandreaslemesou.com/images/auto-clicker-download-roblox-bloxburg-free.pdfIn PDF document text
    • https://gabrieliassociati.com/images/roblox-girl-pants-free.pdfIn PDF document text
    • http://sauer-umweltservice.de/images/hacks-in-roblox-jailbreak.pdfIn PDF document text
    • http://zarinnameh.ir/images/how-do-yoy-get-robux-for-free.pdfIn PDF document text
    • http://cristalysoptic.com/images/free-robux-no-verification-2021.pdfIn PDF document text
    • http://sscclc.edu.ec/images/guy-cheats-on-irl-girlfriend-with-roblox-girlfriend.pdfIn PDF document text
    • http://www.pbconsulting.it/images/checkbackgroundnet-roblox-hack.pdfIn PDF document text
    • http://interpretation-dessins-enfants.net/images/cbro-roblox-hacks-june-2021.pdfIn PDF document text
    • http://www.maakherumusic.net/images/how-to-get-any-hair-for-free-on-roblox.pdfIn PDF document text
    • http://atelierweb.it/images/fun-free-games-like-roblox.pdfIn PDF document text
    • https://www.foodsafety.cz/images/project-evolved-roblox-cheats.pdfIn PDF document text
    • http://lcs-schlieben.de/images/how-do-u-get-free-robux-on-phone.pdfIn PDF document text
    • http://zarinnameh.ir/images/cruise-ship-tycoon-cheats-roblox.pdfIn PDF document text
    • https://kimolos-link.gr/images/how-to-get-free-roblox-robux-codes.pdfIn PDF document text
    • http://lakomat.by/images/how-to-become-a-hacker-in-roblox.pdfIn PDF document text
    +16 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008410.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8410 39224 bytes
SHA-256: c5beefd709485332299592d1c36f1531442ee37699dca50d0307e10177da18d4
font_01_sfnt_off0000d867.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD867 18268 bytes
SHA-256: 6611865891f96f537e726566bf4e5102bb097e6ad4f6fefccdc03f2cad8bab52

Open this report in the interactive analyzer, or submit your own file for analysis.