PDF malware analysis — malicious · 97032d964fa435ed

MALICIOUS

PDF

52.6 KB Created: 2021-04-06 14:05:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29

MD5: 567c74c42f08b7125bb8fe210ac3bed4 SHA-1: 14d26fbaf879d21af78530ab17a411bed87525d2 SHA-256: 97032d964fa435edd9a2af337b1a4b81f8ff04bb78ba9e73db3c06295d0097be

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.8852

Heuristics 4

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- https://newenglandafs.com/images/how-to-hack-games-in-roblox-on-ipad.pdfIn PDF document text
- https://www.apartmanychorvatsko24.cz/images/roblox-tix-factory-for-free.pdfIn PDF document text
- http://progatiplastic.com/images/how-to-get-free-robux-2021-unpatched-trackid-sp006.pdfIn PDF document text
- http://africadaily.co.za/images/free-robux-online-game.pdfIn PDF document text
- https://www.sitiwebjoomla.it/images/robux-hack-tips.pdfIn PDF document text
- http://www.guidaturisticaverona.it/images/roblox-phantom-forces-all-guns-free.pdfIn PDF document text
- http://bullyinformate.org/images/roblox-games-free-online-for-kids.pdfIn PDF document text
- http://lv-siegen.de/images/the-only-working-way-to-get-free-robux.pdfIn PDF document text
- https://verdensbarn.no/images/roblox-players-saying-free-builders-club.pdfIn PDF document text
- http://musical-arts.de/images/free-roblox-cash.pdfIn PDF document text
- http://www.tamogatoweb.hu/images/roblox-games-give-free-robux.pdfIn PDF document text
- http://dialine.cz/images/roblox-hack-download-pc-2021.pdfIn PDF document text
- http://behsanroshd.com/images/roblox-get-eaten-hack.pdfIn PDF document text
- https://www.flexcable.com/images/free-robux-inspect-2021.pdfIn PDF document text
- https://piscinasmundoacuatico.com/images/roblox-free-robux-every-5-seconds.pdfIn PDF document text
- https://hbpbenin.com/images/pastebin-robux-hack.pdfIn PDF document text
- https://stroyzakazremont.ru/images/how-to-get-catalog-items-for-free-roblox-no-hack.pdfIn PDF document text
- https://willifox.com/images/how-to-get-free-catalog-items-on-roblox-2021.pdfIn PDF document text
- http://fratellimazzoleni.it/images/free-robux-money-adder-apk-2021.pdfIn PDF document text
- https://www.milewood.co.uk/images/free-promo-codes-roblox-not-expired.pdfIn PDF document text
- http://citycare.pt/images/best-free-roblox-plane-game.pdfIn PDF document text
- http://hemmet-strand.dk/images/roblox-hack-how-to-get-free-robux-unlimited.pdfIn PDF document text
- http://engelum.com/images/zombie-rush-roblox-hack-v3rmillion.pdfIn PDF document text
- https://www.cnte.org.br/images/roblox-hack-more-13.pdfIn PDF document text
- http://news123.it/images/robux-promode-hack.pdfIn PDF document text
- http://www.drent.se/images/free-tickets-roblox-2021.pdfIn PDF document text
- http://www.hotelcimone.it/images/roblos-free-robux.pdfIn PDF document text
- https://tokunfome.com.br/images/how-to-get-robux-for-free-2021-pc.pdfIn PDF document text
- https://estalagemmonteverde.com.br/images/best-ways-to-get-free-robux.pdfIn PDF document text
- https://jdlgroup.ca/images/cool-skin-roblox-free.pdfIn PDF document text
- http://aadvanderklaauw.nl/images/how-to-donate-robux-for-free.pdfIn PDF document text
- https://liftkos.com/images/set-it-all-free-roblox-id.pdfIn PDF document text
- http://pythonbikers.de/images/free-robux-glitch-roblox-game.pdfIn PDF document text
- http://jijel.info/images/roblox-you-are-kicked-from-this-game-do-not-cheat.pdfIn PDF document text
- http://mainzer-marktplatz.de/images/shirt-roblox-girl-free.pdfIn PDF document text
- http://internetdeputy.com/images/more-robux-for-free.pdfIn PDF document text
- http://boliviagasenergia.com/images/cheating-on-roblox-girlfriend.pdfIn PDF document text
- http://precitool.ch/images/free-robux-june.pdfIn PDF document text
- http://lanoblaie.fr/images/adopt-me-roblox-hack-gui-trolling.pdfIn PDF document text
- https://amatq.ca/images/fly-me-roblox-hack.pdfIn PDF document text
- http://uptodate.az/images/roblox-old-version-free-download.pdfIn PDF document text
- http://abqwinair.com/images/roblox-dragon-ball-z-final-stand-hack-level.pdfIn PDF document text
- https://www.laarsenco.nl/images/roblox-car-free.pdfIn PDF document text
- http://lekarinfo.mk/images/free-robux-for-passes.pdfIn PDF document text
- http://fmbompastor.com.br/images/roblox-titanic-script-hack.pdfIn PDF document text
- http://sb2m.com.br/images/roblox-c00lkidd-hack.pdfIn PDF document text
- https://www.babik-po.cz/images/roblox-theme-park-tycoon-2-cheats.pdfIn PDF document text
- http://lcs-schlieben.de/images/free-robux-robux-king.pdfIn PDF document text
- http://bkd1.balikpapan.go.id/images/roblox-hack-gamepass.pdfIn PDF document text
+12 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006ee6.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6EE6	24900 bytes
SHA-256: `b817e39be46670423571ee19cb96b0db5ea74f2306b8bd73b95435f229b16f6b`
`font_01_sfnt_off0000a81a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA81A	18864 bytes
SHA-256: `f3cfa664e08eaa5e7ea4ea2da5908333963ea5623751bf89fa381368c2d181be`

Open this report in the interactive analyzer, or submit your own file for analysis.