Malicious PDF — malware analysis report

Static analysis result for SHA-256 8fcd7c680762d1bf…

MALICIOUS

PDF

40.5 KB Created: 2021-04-04 02:56:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 11f1e113f7112e18f9fc8cf306a95c8c SHA-1: 9d44da0084b86f58b22945c36169331d0e2e99cc SHA-256: 8fcd7c680762d1bfc676406772001a75ae9b41edc11213ec9bc9b3576714ad59
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to websites that claim to offer free Robux or game hacks, indicative of a scam or phishing lure. The heuristic firings, particularly 'PDF_GAME_HACK_SEO_LINK_FARM', strongly suggest this malicious intent. While no scripts were extracted, the document body and embedded URLs point towards a social engineering attack designed to trick users into visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/getting-robux-free-for-roblox-no-paying PDF link annotation
    • http://salantiskis.lt/images/free-cool-roblox-templates.pdf%0AIn PDF document text
    • http://legs11.co.za/images/how-to-get-free-roblox-items-2021.pdf%0AIn PDF document text
    • https://www.seeingindependence.org/images/roblox-hack-rape.pdf%0AIn PDF document text
    • https://consorziocsa-asicaivano.it/images/get-free-robux-without.pdf%0AIn PDF document text
    • https://kimolos-link.gr/images/free-robux-20219.pdf%0AIn PDF document text
    • http://panaceafamilymedicine.com/images/roblox-how-to-make-a-free-model.pdf%0AIn PDF document text
    • http://ims-77.fr/images/hack-para-hacker-todo-roblox-pastebin.pdf%0AIn PDF document text
    • https://estalagemmonteverde.com.br/images/free-t-shirt-roblox-catalog.pdf%0AIn PDF document text
    • http://www.hawler.in/images/rob-hacker-robux-generator.pdf%0AIn PDF document text
    • http://www.sapaengineering.kz/images/robux-club-free.pdf%0AIn PDF document text
    • https://www.cosmosdawn.net/images/how-to-cheat-in-roblox-get-eaten.pdf%0AIn PDF document text
    • http://echosvoix.ch/images/bear-hack-roblox.pdf%0AIn PDF document text
    • http://kids-academy.pl/images/roblox-jailbreak-hack-keycard-youtube.pdf%0AIn PDF document text
    • https://www.cpnf.ch/images/free-catalog-items-roblox-2021-december.pdf%0AIn PDF document text
    • https://www.najeebqasmi.com/images/how-to-get-free-robux-on-pc-2021.pdf%0AIn PDF document text
    • http://www.drent.se/images/how-do-i-get-free-hair-on-roblox.pdf%0AIn PDF document text
    • http://www.occquimica.com.br/images/how-to-earn-robux-for-free-2021.pdf%0AIn PDF document text
    • http://aiyta.com/images/hoto-get-free-robux-works-100-no-human-no-survey.pdf%0AIn PDF document text
    • https://www.seeingindependence.org/images/noclip-hack-download-for-roblox.pdf%0AIn PDF document text
    • http://sscclc.edu.ec/images/free-robux-obby-link-in-august-2021.pdf%0AIn PDF document text
    • http://www.eurosan1.ba/images/como-conseguir-robux-gratis-en-roblox-2021-hack.pdf%0AIn PDF document text
    • http://www.kalaaliaraq.dk/images/speed-hack-code-for-roblox.pdf%0AIn PDF document text
    • https://esl.ipb.ac.id/images/how-to-glitch-builders-club-for-free-on-roblox.pdf%0AIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/hack-adopt-me-roblox.pdf%0AIn PDF document text
    • https://www.cosmosdawn.net/images/roblox-invitations-free.pdf%0AIn PDF document text
    • http://www.mikramarine.gr/images/dominus-in-roblox-free.pdf%0AIn PDF document text
    • http://hondenspecialist-engelien.nl/images/free-roblox-accounts-with-robux-2021-november.pdf%0AIn PDF document text
    • https://estalagemmonteverde.com.br/images/roblox-bee-simulator-cheats.pdf%0AIn PDF document text
    • https://verdensbarn.no/images/free-roblox-accounts-with-builders-club-2021.pdf%0AIn PDF document text
    • https://corbo.ru/images/how-to-get-free-stuff-in-roblox-catalog-2021.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off00004653.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004653.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4653 23084 bytes
SHA-256: 8caa4f539aec077a9d10b20425cc857f7ca26b1f7b1a5885d160214fd22609e8
font_01_sfnt_off00007a5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A5B 18556 bytes
SHA-256: 83fe2644a82590cd4554863d33909500d7035c68f5d435c3cc1ab6f644ea648e

Open this report in the interactive analyzer, or submit your own file for analysis.