Malicious PDF — malware analysis report

Static analysis result for SHA-256 a56d1cbf68d9c50d…

MALICIOUS

PDF

59.7 KB Created: 2021-04-05 21:10:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: bec02f3e1114cddcf2897c1ff330ea3d SHA-1: 8d27f3bff847d0b4f8f910ee2fbd1a05518cd446 SHA-256: a56d1cbf68d9c50de229bf99f411f74f9735702f0eba94212085a97db89ca99f
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs, with the primary one being http://gaminggenerator.org/app/431946152/free-roam-camera-roblox. Heuristics indicate brand impersonation (Microsoft) and a credential phishing lure, suggesting the document aims to trick users into clicking the link. The presence of numerous similar URLs related to game exploits further supports a malicious intent, likely leading to credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/free-roam-camera-roblox.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-roam-camera-roblox PDF link annotation
    • http://accesslabs.ca/images/robux-hacks-that-actually-work.pdfIn PDF document text
    • https://gomsa.nl/images/how-to-get-free-robux-no-hack-no-download.pdfIn PDF document text
    • http://www.inservis.cl/images/how-to-make-a-group-in-roblox-2021-free.pdfIn PDF document text
    • http://mechanism.gr/images/robux-hack-v1-0.pdfIn PDF document text
    • http://kruiz21.ru/images/free-robux-website-october-2021.pdfIn PDF document text
    • http://www.actae.gr/images/get-robux-free-no-disabling-ad-blocker.pdfIn PDF document text
    • http://www.eurosan1.ba/images/free-roblox-girl-hair-not-a-model-or-decal.pdfIn PDF document text
    • http://www.evaplast.by/images/how-to-save-a-free-model-in-roblox.pdfIn PDF document text
    • https://inspiration-modellbau.de/images/roblox-speeed-hack.pdfIn PDF document text
    • https://lesegais.ru/images/how-to-make-a-group-in-roblox-for-free.pdfIn PDF document text
    • http://kulturhusbabberich.nl/images/hack-scripts-roblox-may-5.pdfIn PDF document text
    • http://www.mikramarine.gr/images/free-roblox-accounts-past.pdfIn PDF document text
    • http://www.marambio.com.ar/images/roblox-champion-bag-free.pdfIn PDF document text
    • http://famoirs.co.uk/images/robux-hack-2021-apk-download.pdfIn PDF document text
    • https://www.seeingindependence.org/images/roblox-free-robux-no-password-for.pdfIn PDF document text
    • http://principessalialaofegypt.com/images/roblox-strucid-free-skin-tutorial.pdfIn PDF document text
    • https://www.milewood.co.uk/images/roblox-admin-commands-hack-with-cheat-engine-62.pdfIn PDF document text
    • https://www.gvandenakker.nl/images/how-to-work-get-a-roblox-hack-gui-to-work.pdfIn PDF document text
    • http://eooe.gr/images/tiroblox-cheats-for-robux-and-tix-robloxcheatsnet-roblox.pdfIn PDF document text
    • http://mittlenberg.ch/images/1x1x1x1x-roblox-hack.pdfIn PDF document text
    • http://ernstgloves.co.il/images/how-to-get-free-robux-2021-by-uing-inspect.pdfIn PDF document text
    • http://domaizdereva24.ru/images/free-robux-2021.pdfIn PDF document text
    • http://gavertrimmers.be/images/games-that-will-actually-give-you-free-robux.pdfIn PDF document text
    • http://muko-unterfranken.info/images/how-to-get-free-robux-no-videos.pdfIn PDF document text
    • https://www.stayon.no/images/free-items-on-roblox-hack.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/roblox-hack-2021-no-survey.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/how-to-open-cheat-engine-in-roblox-2021.pdfIn PDF document text
    • http://www.drent.se/images/urbx-club-roblox-free-robux.pdfIn PDF document text
    • http://www.actae.gr/images/how-to-hack-roblox-counter-blox.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/roblox-free-neck-accessories.pdfIn PDF document text
    • http://stomatolog-choszczno.pl/images/free-roblox-group-giving-robux.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/roblox-what-is-e-free.pdfIn PDF document text
    • http://schrichte.de/images/robux-hack-no-human-verification-pc.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/hack-somebody-on-roblox.pdfIn PDF document text
    • https://www.albisser.ch/images/roblox-prison-life-v20-cheats-noclip-and-btools.pdfIn PDF document text
    • https://rietenwinkel.nl/images/roblox-hack-anti-ban.pdfIn PDF document text
    • https://www.udivadlahotel.cz/images/how-to-get-free-robux-dount-shop.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/como-hackear-robux-en-roblox-facil-y-rapido.pdfIn PDF document text
    • http://bned-leader.co.uk/images/how-to-get-free-robux-advertisment.pdfIn PDF document text
    • http://ernstgloves.co.il/images/free-promocodes-roblox-body.pdfIn PDF document text
    • http://instrumenttut.by/images/how-to-get-free-robux-buzz.pdfIn PDF document text
    • http://escolaarboc.cat/images/cheat-roblox-diamond.pdfIn PDF document text
    • https://tokunfome.com.br/images/unlimited-robux-hack-2021.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/get-free-robux-without.pdfIn PDF document text
    • https://www.tsdb.com.au/images/gravity-roblox-cheat.pdfIn PDF document text
    • https://www.colditex.com/images/dife-cf-free-robux.pdfIn PDF document text
    • https://lesegais.ru/images/roblox-robeats-hack.pdfIn PDF document text
    • http://bb-im2.com/images/how-to-get-free-robux-2021-on-iphone.pdfIn PDF document text
    • http://www.evaplast.by/images/how-to-save-a-free-model-in-In PDF document text
    +16 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000835b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x835B 25672 bytes
SHA-256: e9e5c7fe3e159d3f36845522f1e9d4b5c5af979b2f06d2b4aefbd634c239a046
font_01_sfnt_off0000be2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE2B 2832 bytes
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2
font_02_sfnt_off0000c7db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC7DB 17668 bytes
SHA-256: 7716c0df85d71919ad47a43486cdb63609fc26d9173ec2937b3ac854643e7367

Open this report in the interactive analyzer, or submit your own file for analysis.