Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c05cde5a3506f99…

MALICIOUS

PDF

54.0 KB Created: 2021-04-06 14:38:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 13391948bdd2ba724693d71eaf29a7d6 SHA-1: fb620ee0b50cd8deccf0d6ab2b398b265c0da0c8 SHA-256: 8c05cde5a3506f994fff04a16d6acb55971b977443081c18ff8362af9db2e939
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a primary lure related to 'Roblox Planet Hack' and 'free generator / game hack'. The document body and heuristics indicate that the primary goal is to trick the user into clicking a link, such as https://enigmagenerator.com/app/431946152/roblox-game-hack, which likely leads to a malicious website or further download. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest a social engineering attack to drive users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8413

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://fm-express.de/images/roblox-demo-free-download.pdfIn PDF document text
    • http://sdsdar.org/images/how-to-get-free-robux-on-places-roblox.pdfIn PDF document text
    • https://septik-montag.ru/images/rbx-points-free-robux.pdfIn PDF document text
    • https://icefuture.ru/images/get-free-group-roblox.pdfIn PDF document text
    • http://maslabaou.com/images/how-to-hack-robux-with-cheat-engine.pdfIn PDF document text
    • http://www.eurosan1.ba/images/free-robux-lebansay-group.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/cheat-teleportation-roblox.pdfIn PDF document text
    • http://bibliotheque-perrigny-les-dijon.fr/images/how-do-you-earn-robux-for-free.pdfIn PDF document text
    • http://rushxpress.de/images/how-to-hack-adopt-me-roblox.pdfIn PDF document text
    • https://www.lavigny.ch/images/how-to-cheat-in-meepcity-roblox.pdfIn PDF document text
    • http://harmonygardens.ca/images/roblox-free-download-ps-vita.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/claimrbx-earn-free-robux.pdfIn PDF document text
    • http://fotoflas.gr/images/rbxcash-robux-free.pdfIn PDF document text
    • http://fairwaygolftravel.co.uk/images/btools-roblox-hack-download-2021.pdfIn PDF document text
    • https://digitalsenseafrica.com.ng/images/free-roblox-toy-codes-november-2021.pdfIn PDF document text
    • http://echosvoix.ch/images/script-executor-roblox-download-free-2021.pdfIn PDF document text
    • https://www.eglihotel.gr/images/hack-roblox-phantom-forces-2021.pdfIn PDF document text
    • https://hbpbenin.com/images/free-robux-legal-2021.pdfIn PDF document text
    • http://www.danzamaniapergine.it/images/combo-free-roblox.pdfIn PDF document text
    • http://pesok-rk.ru/images/free-roblox-audio-sounds-songs-chill-bill.pdfIn PDF document text
    • https://elite-house.su/images/free-robux-generator-links.pdfIn PDF document text
    • https://camillesplace.org/images/free-robux-generator-no-survey-or-human-verification-2021.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/cheat-engine-alternative-for-roblox.pdfIn PDF document text
    • https://www.accessoriperdisabili.com/images/free-dominus-roblox-avatar.pdfIn PDF document text
    • https://www.hbproducts.dk/images/aimbot-roblox-hack.pdfIn PDF document text
    • http://lillysonthelake.com/images/roblox-proxo-hack.pdfIn PDF document text
    • http://s-punkt-objects.de/images/free-robux-codes-on-tablet-2021.pdfIn PDF document text
    • https://www.cnte.org.br/images/free-roblox-you-can-play-online.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/do-roblox-read-hack-reports.pdfIn PDF document text
    • http://www.metinadistribuzione.com/images/roblox-f12-cheat.pdfIn PDF document text
    • http://genialica.de/images/roblox-hack-robux-hack.pdfIn PDF document text
    • http://behsanroshd.com/images/how-to-get-free-bc-tbc-obc-and-robux.pdfIn PDF document text
    • http://revival-gang.de/images/roblox-hacking-chrome-extension.pdfIn PDF document text
    • https://www.ukrtrans.biz/images/how-to-get-free-models-on-roblox.pdfIn PDF document text
    • http://portal.crfsp.org.br/images/roblox-generator-robux-free.pdfIn PDF document text
    • http://www.mostraining.co.za/images/how-to-geht-free-robux-no-human.pdfIn PDF document text
    • http://lamascheradiferro.dk/images/add-robux-for-free.pdfIn PDF document text
    • http://hemmet-strand.dk/images/how-do-you-hack-roblox-users.pdfIn PDF document text
    • http://alroglobal.com/images/how-to-crack-a-roblox-hack-made-in-visual-studio.pdfIn PDF document text
    • http://smoothjazzclub.net/images/free-roblox-codes-twitter.pdfIn PDF document text
    • http://christiansymbolkits.com/images/getbux-me-free-robux.pdfIn PDF document text
    • http://ff-obertraun.at/images/free-roblox-meme-avatars.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/fly-hack-roblox-cheatgg.pdfIn PDF document text
    • http://kim-kinder-im-mittelpunkt.de/images/roblox-how-to-get-free-items-in-game.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/lumber-tycoon-hack-roblox.pdfIn PDF document text
    • http://biotronics.com.cy/images/roblox-how-to-get-infinite-robux2021-no-hack-no-cheats.pdfIn PDF document text
    • http://gbp-trabkiwielkie.pl/images/can-you-hack-on-roblox.pdfIn PDF document text
    • http://wsit.at/images/how-to-get-free-robux-no-waiting-now.pdfIn PDF document text
    • http://news123.it/images/free-150-robux.pdfIn PDF document text
    +9 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000705d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x705D 28544 bytes
SHA-256: f2c36a521952063f52575a3427c5112a5469847a7160d5f1f2d46be1ce37dcea
font_01_sfnt_off0000b0a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB0A4 17820 bytes
SHA-256: 0a07cc440331e294ce349a9ecb436a5202d19e85e822edcdb025a776f4776f8c

Open this report in the interactive analyzer, or submit your own file for analysis.