Malicious PDF — malware analysis report

Static analysis result for SHA-256 a136a09aa920fe52…

MALICIOUS

PDF

245.1 KB Created: 2021-04-04 10:52:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 159f461f0f26e96f99b3941af3ee5c56 SHA-1: c079daafcfc1d66d9f0afdd847bfbd1ce7deae67 SHA-256: a136a09aa920fe5210df62bedc1618ef2f2e0c1cd9f538d55348a297658499b6
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is detected as malicious by ClamAV and exhibits characteristics of a phishing lure, including an image-only presentation and a call-to-action button. The document body, though heavily obfuscated, suggests a lure related to 'Robux Hack'. The presence of numerous external URLs indicates an attempt to redirect the user to potentially malicious sites for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier clean score 0.1227

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 245 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/robux-hack-no-human-verify-2021 PDF link annotation
    • http://domaizdereva24.ru/images/fly-script-hack-roblox.pdfIn PDF document text
    • http://schlossschaenke-andernach.de/images/redline-roblox-cheat-download-give-me-the-fucking-cheat-rn.pdfIn PDF document text
    • http://smoothjazzclub.net/images/roblox-maze-runner-cheats.pdfIn PDF document text
    • http://scuttworksdesigns.us/images/free-roblox-accounts-login-august-2021.pdfIn PDF document text
    • http://www.inservis.cl/images/roblox-free-robux-no-survey-no-password.pdfIn PDF document text
    • https://www.apartmanychorvatsko24.cz/images/how-to-cheat-robux-in-roblox-2021.pdfIn PDF document text
    • http://dorfgaragethalwil.ch/images/how-to-get-free-robux-2021-sylvester.pdfIn PDF document text
    • https://semanasantacehegin.com/images/roblox-is-free-to-play.pdfIn PDF document text
    • http://wcasrock.org/images/roblox-hack-tool-no-survey-only-images.pdfIn PDF document text
    • http://ghegamethu.vn/images/super-pug-youtube-how-to-get-free-robux.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/fps-hacks-roblox-aimbot-not-pf-v21.pdfIn PDF document text
    • http://santeh-40.ru/images/brick-bronze-roblox-cheats.pdfIn PDF document text
    • http://www.copoint.co.uk/images/how-to-get-free-robux-hack-2021.pdfIn PDF document text
    • https://pagadder.com/images/all-roblox-promo-codes-free-items.pdfIn PDF document text
    • http://joshherman.com/images/how-do-you-hack-and-make-yourself-bigger-on-robloxs.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/hack-for-project-sepra-roblox.pdfIn PDF document text
    • http://www.controverseinterapie.it/images/free-robux-without-human-verification-and-no-sureys-or-downloads.pdfIn PDF document text
    • http://ff-obertraun.at/images/red-pants-roblox-free.pdfIn PDF document text
    • http://evro-okna.net/images/roblox-free-admin-tc2.pdfIn PDF document text
    • http://www.copoint.co.uk/images/unlimited-free-robux-generator.pdfIn PDF document text
    • https://www.porthos.it/images/roblox-galaxy-cheats.pdfIn PDF document text
    • https://www.lomrad.go.th/images/roblox-hacker-shirt.pdfIn PDF document text
    • https://grovehilloutfitters.com/images/free-cookies-roblox.pdfIn PDF document text
    • http://www.art-concept.gr/images/how-to-get-any-item-in-roblox-free.pdfIn PDF document text
    • http://stackideas.com/images/roblox-jailbreak-cheat-engine-money-hack.pdfIn PDF document text
    • http://dorfgaragethalwil.ch/images/noclip-hack-for-prison-liferoblox.pdfIn PDF document text
    • http://www.eptaviation.com/images/roblox-free-rainbow-wings.pdfIn PDF document text
    • http://www.apocalissedigesucristo.com/images/how-admins-get-free-robux.pdfIn PDF document text
    • https://lesegais.ru/images/hackear-roblox-sin-inspeccionar.pdfIn PDF document text
    • http://alpen-seeblick.at/images/bxworld-free-robux.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00038055.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38055 19256 bytes
SHA-256: f8ffd8e21a4b1232b4209118d7c09c4bde12da1636e8eb15a79e3e8e5747740c
font_01_sfnt_off0003a8d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A8D4 19036 bytes
SHA-256: 27efae61bb35fa4b14777cfe7902ec122584fb3adf83f36f4cad3f3522653516

Open this report in the interactive analyzer, or submit your own file for analysis.