Malicious PDF — malware analysis report

Static analysis result for SHA-256 990bf96740472f97…

MALICIOUS

PDF

234.7 KB Created: 2021-04-05 01:28:17 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 295aa3de5400414330ef29c92b5ed439 SHA-1: 8e9ea9fa714a8b6d3c733ec52cf5d1ec2400a6b3 SHA-256: 990bf96740472f9714258611052eac2550ca4ebcbea1637a56e7077a7da45466
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of external URIs. The document body, though heavily obfuscated, contains text related to 'Roblox Token Hack' and the extracted URLs are all related to 'free Robux' or 'Roblox hacks', strongly suggesting a phishing or scam attempt. No scripts were extracted, but the presence of external links indicates a likely attempt to redirect the user to a malicious website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7299

Heuristics 3

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/assassin-roblox-token-hack PDF link annotation
    • https://liceucastrodelapenya.com/images/robux-hack-no-verification-no-survey.pdfIn PDF document text
    • http://www.occquimica.com.br/images/easy-way-to-get-free-robux-on-roblox.pdfIn PDF document text
    • http://www.comitatoiseo.org/images/bloxawards-com-earn-free-robux.pdfIn PDF document text
    • http://asiasieja.pl/images/obc-for-free-on-roblox.pdfIn PDF document text
    • http://linde-erbach.de/images/roblox-deutsch-free-download.pdfIn PDF document text
    • https://tokunfome.com.br/images/roblox-hack-to-get-free-robux-youtube.pdfIn PDF document text
    • http://eddegrootassurantien.nl/images/how-to-get-robux-for-free-simpl-steps.pdfIn PDF document text
    • http://avocatultau.eu/images/is-roblox-getting-hacked.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/roblox-dll-hack-download.pdfIn PDF document text
    • https://koeltotaal.com/images/free-robux-gft-cards.pdfIn PDF document text
    • http://petarda.hu/images/roblox-restaurant-tycoon-hacks.pdfIn PDF document text
    • http://bned-leader.co.uk/images/free-roblox-gift-card-generator-no-survey.pdfIn PDF document text
    • https://digitalsenseafrica.com.ng/images/free-robux-every-day.pdfIn PDF document text
    • https://www.eglihotel.gr/images/how-to-hack-stats-in-dragon-ball-ultimate-warriors-roblox.pdfIn PDF document text
    • http://schottlandfieber.de/images/roblox-free-robux-hack-penguin.pdfIn PDF document text
    • http://innovativefs.co.uk/images/roblox-exploit-gui-free.pdfIn PDF document text
    • http://www.guidaturisticaverona.it/images/roblox-prison-life-glitches-and-hacks.pdfIn PDF document text
    • http://moralcenter.or.th/images/roblox-guest-666-shirt-free.pdfIn PDF document text
    • https://www.appartamenticroazia24.com/images/dantdm-get-free-robux.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/unicorn-how-to-get-free-robux-youtube.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036a52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36A52 21500 bytes
SHA-256: 400054a36858976ed8f991e7c70fe475a21988b8d598f6007b2c9c404aa0f7e5

Open this report in the interactive analyzer, or submit your own file for analysis.