Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5662741f51e4288…

MALICIOUS

PDF

40.9 KB Created: 2021-04-03 23:36:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: efdbb1dfd6646e1666b751102d466b06 SHA-1: c299e2ded4360253d2b94b0fd9e365ae8ffa763e SHA-256: a5662741f51e4288ca036d0e79c09ef8a44aab1fd242d74f756908711aaf1f56
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a call-to-action phrase, strongly suggesting a phishing or malware distribution attempt. The ML classifier also flagged this PDF as malicious. The document body and embedded links point towards lures for Roblox-related hacks or in-game currency, a common theme in social engineering attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 4

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-free-name-change-hack
    • https://meltonschool.org/images/how-to-escape-prison-life-roblox-hack.pdf%0A
    • https://www.najeebqasmi.com/images/how-to-get-a-free-monster-truck-in-roblox-jailbreak.pdf%0A
    • http://www.mikramarine.gr/images/free-cute-hair-for-roblox.pdf%0A
    • http://www.mikramarine.gr/images/how-to-get-free-robux-no-inspect-no-waiting.pdf%0A
    • https://www.saisystem.it/images/best-roblox-hacks-gui.pdf%0A
    • http://www.torvet11.dk/images/how-to-get-tix-on-roblox-with-cheat-engine.pdf%0A
    • https://www.utalii.ac.ke/images/how-hack-account-roblox.pdf%0A
    • http://www.remiauclair.fr/images/how-to-get-free-robux-without-having-to-do-anything.pdf%0A
    • https://www.ghknights.org/images/free-roblox-money-generator.pdf%0A
    • https://www.najeebqasmi.com/images/how-get-free-robux-in-roblox.pdf%0A
    • http://uctovnictvosnv.sk/images/free-roblox-clothes-for-girl.pdf%0A
    • http://www.vktzunami.cz/images/hgow-to-get-free-robux.pdf%0A
    • http://hemmet-strand.dk/images/how-to-hack-roblox-tycoons-with-cheat-engine-64.pdf%0A
    • https://koeltotaal.com/images/how-to-hack-to-get-infinite-robux-in-roblox.pdf%0A
    • https://esl.ipb.ac.id/images/roblox-vtool-hack.pdf%0A
    • https://www.wildpark-johannismuehle.de/images/free-version-of-synapse-roblox.pdf%0A
    • https://consorziocsa-asicaivano.it/images/how-to-get-robux-for-free-on-a-huawei.pdf%0A
    • http://www.actae.gr/images/hack-de-robux-2021-funcionando.pdf%0A
    • http://stomatolog-choszczno.pl/images/free-redeem-code-roblox-2021.pdf%0A
    • http://businessmart.ro/images/how-to-hack-roblox-copy-any-roblox-game.pdf%0A
    • http://www.anies.eu/images/free-groups-to-join-roblox.pdf%0A
    • http://www.actae.gr/images/panel-de-hacks-de-roblox.pdf%0A
    • http://www.web.stc-part.co.th/images/jailbreak-roblox-hack.pdf%0A
    • http://www.copoint.co.uk/images/invisibleble-hack-roblox-wearedevs.pdf%0A
    • http://schrichte.de/images/best-paid-roblox-hacks.pdf%0A
    • http://uctovnictvosnv.sk/images/are-there-free-roblox-game.pdf%0A
    • http://learningarabic.co.uk/images/roblox-doom-cheats.pdf%0A
    • https://www.brainpads.com/images/free-robux-cmd.pdf%0A
    • http://uctovnictvosnv.sk/images/roblox-hack-tool-no-download.pdf%0A
    • https://www.lomrad.go.th/images/free-robux-no-downloading-games.pdf%0A
    • http://uctovnictvosnv.sk/images/roblox-hack-tool-
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004506.bin
021711d6677fde56c60ab6b2304f31dd393cf1adcf197770958b0469b544042e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4506 24696 bytes
font_01_sfnt_off00007be7.bin
ecae238d3563a231a037dadd9f34c2c045caaa45256c66c90016d28c1cfb99ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BE7 18592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.