PDF malware analysis — malicious · 9385d8ac095eeecb

MALICIOUS

PDF

58.7 KB Created: 2021-04-06 06:32:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-26

MD5: 1b28cb2075b38f3224a5c43ff6c11bcd SHA-1: 20c4448ba458d9145cc7fc23c91a824100342fe6 SHA-256: 9385d8ac095eeecbe79f304ee06c821f4cfe89280bdd003e81549aed830a0f88

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure related to obtaining free in-game currency for Roblox, directing users to a suspicious URL. Heuristics indicate this is a browser extension installation lure, a common tactic for credential theft or malware delivery. While no scripts were directly extracted, the PDF structure and embedded URLs suggest a malicious intent to redirect users to potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.7795

Heuristics 6

PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- https://jdlgroup.ca/images/free-robux-domino-crown.pdfIn PDF document text
- http://joshherman.com/images/how-to-get-free-robux-the-real-way.pdfIn PDF document text
- https://www.hbproducts.dk/images/how-to-bypass-roblox-cheat-engine.pdfIn PDF document text
- https://gimnaziya6.kz/images/how-to-get-free-robux-commercial.pdfIn PDF document text
- http://behsanroshd.com/images/how-to-hack-roblox-like-a-boss.pdfIn PDF document text
- http://infoagronomia.com.ar/images/how-to-get-300-robux-for-free-100-working.pdfIn PDF document text
- https://www.tsdb.com.au/images/roblox-paid-hack.pdfIn PDF document text
- http://italymania.ru/images/roblox-arsenal-hack-script-download.pdfIn PDF document text
- https://www.najeebqasmi.com/images/roblox-tix-lord-hack.pdfIn PDF document text
- https://verdensbarn.no/images/how-to-get-cool-hair-on-roblox-for-free.pdfIn PDF document text
- http://xn----7sbabhw4a8b0addm1c.xn--p1ai/images/roblox-robux-hack-2021-youtube.pdfIn PDF document text
- http://stroygrad-spb.com/images/bee-swarm-roblox-hacks-2021.pdfIn PDF document text
- https://www.elevage-chiot.fr/images/free-roblox-game-stolen.pdfIn PDF document text
- http://ce-tsv-nantes.fr/images/roblox-speed-hack-script-v3rmilion.pdfIn PDF document text
- http://www.pbconsulting.it/images/pineapple-outfit-hack-roblox-royale-high.pdfIn PDF document text
- http://lekarinfo.mk/images/aimbot-hack-roblox-comnand-promt.pdfIn PDF document text
- http://jbm-constructions.com/images/free-robuxs-hacks-trackid-sp006.pdfIn PDF document text
- http://www.barsa.it/images/how-to-hack-rap-in-case-clicker-roblox.pdfIn PDF document text
- http://avocatultau.eu/images/how-to-get-free-robux-fast-on-computer.pdfIn PDF document text
- https://www.osoc.com/images/free-robux-obby-no-password-2021.pdfIn PDF document text
- https://bdhcpa.com/images/how-to-get-cheat-engine-on-mac-roblox.pdfIn PDF document text
- http://acktivities.com/images/how-to-get-free-robux-online.pdfIn PDF document text
- http://www.fluidtech.hu/images/how-to-gte-free-robux-codes-for-pc-2021-october.pdfIn PDF document text
- http://teknotools.net/images/roblox-fire-truck-hack.pdfIn PDF document text
- http://suryaartajaya.co.id/images/roblox-sad-cheating-story-lbert.pdfIn PDF document text
- http://properteez.com/images/free-pins-of-robux.pdfIn PDF document text
- http://jijel.info/images/jeuxvideo-free-robux.pdfIn PDF document text
- http://the-specials.ch/images/roblox-hack-mining-simulator-rebhirt.pdfIn PDF document text
- http://www.fluidtech.hu/images/free-robux-codes-2021-no-survey.pdfIn PDF document text
- http://www.copoint.co.uk/images/legends-of-speed-cheats-roblox.pdfIn PDF document text
- http://www.agri-tech.com.au/images/buy-robux-for-free-games.pdfIn PDF document text
- http://hospitalsalamanca.cl/images/aplicaciones-para-hackear-roblox.pdfIn PDF document text
- http://genialica.de/images/how-to-get-robux-for-free-in-jailbreak.pdfIn PDF document text
- http://restarmenia.com/images/free-draw-2-roblox-drawing-tablet.pdfIn PDF document text
- http://www.web.stc-part.co.th/images/roblox-hack-get-infinate-money-on-bloxburg.pdfIn PDF document text
- http://salantiskis.lt/images/roblox-secret-cheat-codes-for-music-its-raining-tacos.pdfIn PDF document text
- http://www.torvet11.dk/images/download-roblox-hack-apk-pc.pdfIn PDF document text
- http://gamixpaliwa.pl/images/dragon-ball-z-roblox-training-hack.pdfIn PDF document text
- http://pa-bengkulukota.go.id/images/how-to-hack-any-roblox-account-with-their-roblosecurity.pdfIn PDF document text
- https://www.banhngoncaocap.com/images/free-roblox-robux-ohne-handynummer.pdfIn PDF document text
- https://www.inova-cuisine.fr/images/roblox-aerial-free.pdfIn PDF document text
- http://hk-kan.org/images/roblox-restaurant-tycon-cheat.pdfIn PDF document text
- http://ottawavalleykitchens.ca/images/how-to-hack-on-roblox-games-2021.pdfIn PDF document text
- https://www.dierenartsberghman.be/images/lingojam-roblox-hack.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/free-robux-hacks-may-2021.pdfIn PDF document text
- http://gamixpaliwa.pl/images/hack-in-roblox-games.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/roblox-games-hack-download.pdfIn PDF document text
- http://ohsawamacrobiotics.com/images/free-cute-roblox-tops.pdfIn PDF document text
- https://www.coriglianocalabro.it/images/roblox-jailbreak-hack-ios.pdfIn PDF document text
+16 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00008370.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x8370	27720 bytes
SHA-256: `228349fb693fca844d3a75d886264e8780e1ca75078e3b878192f7a944021308`
`font_01_sfnt_off0000c28b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC28B	18164 bytes
SHA-256: `9a1a80a5493f5626276338182c2237be4d888a340a64d7644a9db6b754fc61e8`

Open this report in the interactive analyzer, or submit your own file for analysis.