PDF malware analysis — malicious · 9f8798c8195389c8

MALICIOUS

PDF

59.5 KB Created: 2021-04-05 19:00:34 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-25

MD5: b3e295a3d985c22cb42d8cb966a6aeca SHA-1: 19f8090055f57228b52c8742cce1b7b85f377490 SHA-256: 9f8798c8195389c83f0d4751f0c1c8ba526c2977518fe2cf01acd09b1ac25ae6

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

This PDF document was flagged as malicious by an ML classifier. It uses brand-impersonation credential phishing. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.6193

Heuristics 4

Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/free-robux-games-on-the-front-page.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/free-robux-games-on-the-front-page PDF link annotation
- http://iacovoulaw.com/images/free-roblox-accounts-2021-october.pdfIn PDF document text
- http://ns1.radiofacil.net/images/give-me-free-robux-plz.pdfIn PDF document text
- http://www.gadanie.lv/images/how-to-hack-roblox-acount-websires.pdfIn PDF document text
- https://domoticaaplicada.com/images/tutorial-hack-roblox-robux.pdfIn PDF document text
- http://kfz-ilg.com/images/free-robux-hack-2021-generator.pdfIn PDF document text
- http://www.teapotjewelry.com/images/free-robux-generator-codes.pdfIn PDF document text
- http://www.lycee-langevin-wallon.com/images/como-conseguir-robux-gratis-sin-hacks-con-dos-links.pdfIn PDF document text
- https://www.lavigny.ch/images/red-boy-robux-hack.pdfIn PDF document text
- http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/roblox-guess-the-famous-characters-answers-cheat-sheets.pdfIn PDF document text
- http://www.hotelcomelico.it/images/free-robux-converter.pdfIn PDF document text
- http://www.fanciullovito.it/images/free-account-roblox-2021.pdfIn PDF document text
- http://echosvoix.ch/images/how-to-create-a-roblox-hack.pdfIn PDF document text
- https://gomsa.nl/images/best-roblox-best-troll-hacks-2021.pdfIn PDF document text
- http://www.nielsen2u.dk/images/free-accessories-in-roblox-codes.pdfIn PDF document text
- https://www.najeebqasmi.com/images/how-to-get-anything-in-the-roblox-catalog-for-free.pdfIn PDF document text
- https://reggieslockandkey.com/images/roblox-script-executor-free-download-2021.pdfIn PDF document text
- http://www.evaplast.by/images/roblox-undertale-monster-mania-how-to-get-reset-2-free.pdfIn PDF document text
- http://energyline.co/images/free-202120212021202120212021202120212021202120212021-robux.pdfIn PDF document text
- http://asiasieja.pl/images/codes-for-free-knifes-assasin-roblox.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/how-to-hack-knifes-in-assassin-roblox.pdfIn PDF document text
- http://www.drent.se/images/inject-hackcom-roblox-app.pdfIn PDF document text
- http://www.lascalamilanowallcovering.it/images/how-to-get-free-stuff-on-roblox-on-ipad.pdfIn PDF document text
- https://www.stkdb.cz/images/wwwroblox-jailbreak-hack.pdfIn PDF document text
- http://evro-okna.net/images/1-million-robux-for-free-free-robux.pdfIn PDF document text
- http://www.marambio.com.ar/images/free-catalog-in-roblox-2021.pdfIn PDF document text
- http://buvis.is/images/roblox-guess-that-character-for-free-robux.pdfIn PDF document text
- http://www.exikom.com.ua/images/thebesian-get-roblox-ninja-animation-free.pdfIn PDF document text
- http://learningarabic.co.uk/images/how-to-get-free-outfits-on-roblox.pdfIn PDF document text
- http://goosesscuba.com/images/how-to-hack-roblox-games-without-downloads.pdfIn PDF document text
- http://kruiz21.ru/images/how-to-hack-roblox-to-get-robux-2021.pdfIn PDF document text
- http://ff-klaffenbach.de/images/how-to-get-free-robux-chrome-console.pdfIn PDF document text
- http://behsanroshd.com/images/free-robux-codes-that-haven-39.pdfIn PDF document text
- https://www.cpnf.ch/images/roblox-hack-2-player-superhero-tycoon.pdfIn PDF document text
- https://wandersuechtig.de/images/roblox-counter-blox-hack.pdfIn PDF document text
- http://agroturismoarkaia.com/images/roblox-hack-google-chrome.pdfIn PDF document text
- https://socialvalue.gr/images/roblox-logo-hacked.pdfIn PDF document text
- http://racunari.in.rs/images/free-robux-exploit-download.pdfIn PDF document text
- https://www.academiaanticorrupcion.org/images/my-free-roblox-account.pdfIn PDF document text
- http://www.centromedicoaurora.it/images/free-obc-codes-roblox-unused.pdfIn PDF document text
- http://hotel-buta.by/images/all-of-the-free-wings-on-roblox.pdfIn PDF document text
- http://iacovoulaw.com/images/increible-hack-de-roblox-que-funciona.pdfIn PDF document text
- http://hemmet-strand.dk/images/free-robux-script-v3rmillion.pdfIn PDF document text
- http://www.isril.it/images/roblox-free-angel-wings.pdfIn PDF document text
- http://ilcommercialista.info/images/free-roblox-account-with-robux-on-it.pdfIn PDF document text
- http://uctovnictvosnv.sk/images/notoriety-hacks-pastebin-roblox.pdfIn PDF document text
- http://artcustomdrums.com/images/free-afro-roblox.pdfIn PDF document text
- https://verdensbarn.no/images/free-roblox-accessories.pdfIn PDF document text
- http://huananhai.net/images/roblox-robux-hack-zone.pdfIn PDF document text
- http://smoothjazzclub.net/images/roblox-egg-hunt-cheat-sheet.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000081a5.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x81A5	24832 bytes
SHA-256: `fc584d7affe2b606c4c376d3a76b0519ad2d84023b336b659d5134037721c45d`
`font_01_sfnt_off0000b9c2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB9C2	2832 bytes
SHA-256: `77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2`
`font_02_sfnt_off0000c372.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC372	18800 bytes
SHA-256: `599daabeac940f82d0a15b9585cfa64b055cbb73a67570ff550e08ceb4e3c615`

Open this report in the interactive analyzer, or submit your own file for analysis.