Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5dbad34e6d18d12…

MALICIOUS

PDF

60.8 KB Created: 2021-04-05 21:47:34 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 4d6ade84ede490cc7a674f198af300a1 SHA-1: f9494db3ee6fcfe986e3b0b3a3d4b826809bccf0 SHA-256: a5dbad34e6d18d12e6b3334ff47203e8a4860630ba29da2b9729d913ef0a4b99
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous links to websites that claim to offer free Robux or hacks for the game Roblox. These links are presented as a 'link farm' designed to lure users to scam sites. The presence of multiple game-hack related URLs and the ML classifier output strongly indicate a malicious intent to deceive users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/bux-gg-roblox-free PDF link annotation
    • http://sscclc.edu.ec/images/free-antlers-roblox.pdfIn PDF document text
    • http://altc.de/images/free-virtual-code-roblox.pdfIn PDF document text
    • https://ghpa.ru/images/gamefreaks-free-robux.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/get-free-robux-info.pdfIn PDF document text
    • https://www.nema.go.ke/images/how-to-hack-roblox-robux-on-ipad.pdfIn PDF document text
    • http://www.occquimica.com.br/images/free-robux-2021-no-human-verification-or-survey.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/roblox-free-login.pdfIn PDF document text
    • http://iricamidelcuore.it/images/how-to-get-any-roblox-game-for-free.pdfIn PDF document text
    • http://global-tech-security.be/images/games-on-roblox-that-give-you-free-robux-2021.pdfIn PDF document text
    • http://www.boic.nl/images/how-to-hack-into-a-roblox-account-2021.pdfIn PDF document text
    • http://huananhai.net/images/roblox-aofe-arc-cheat.pdfIn PDF document text
    • http://learningarabic.co.uk/images/free-robux-without-human-verification-ios.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/how-to-become-a-real-roblox-hacker.pdfIn PDF document text
    • http://www.visiblefilm.com/images/robux-hack-no-survey-2021.pdfIn PDF document text
    • http://fratellimazzoleni.it/images/roblox-dead-winter-hack-2021.pdfIn PDF document text
    • http://goosesscuba.com/images/free-roblox-catalog-items-2021.pdfIn PDF document text
    • http://grupodin.com.br/images/roblox-hacks-exploits-2021.pdfIn PDF document text
    • http://piadaandco.it/images/free-money-script-roblox.pdfIn PDF document text
    • http://www.lascalamilanowallcovering.it/images/free-robux-hack-2021-december.pdfIn PDF document text
    • http://www.maakherumusic.net/images/roblox-bloxburg-free-bs.pdfIn PDF document text
    • https://studentcareerinfo.com/images/free-robux-tutorial.pdfIn PDF document text
    • https://eleganceautospa.ca/images/roblox-hacking-jailbreak-unlimited-money-omg.pdfIn PDF document text
    • http://farwesterndistrict.org/images/thing-for-free-on-roblox.pdfIn PDF document text
    • http://www.hawler.in/images/hacks-to-get-into-houses-on-roblox.pdfIn PDF document text
    • http://hydroconseil.com/images/get-free-free-robux.pdfIn PDF document text
    • http://bagna.pl/images/free-roblox-pokemon-go.pdfIn PDF document text
    • https://www.hotschool.com.au/images/cheat-engine-god-mode-script-roblox.pdfIn PDF document text
    • http://legs11.co.za/images/roblox-hack-add.pdfIn PDF document text
    • http://kermas.eu/images/roblox-real-robux-hack.pdfIn PDF document text
    • http://fm-express.de/images/groups-that-give-you-free-robux-instantly.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/fairy-world-hack-roblox.pdfIn PDF document text
    • https://digitalsenseafrica.com.ng/images/how-to-get-free-daiblo-in-ultimate-drive-roblox.pdfIn PDF document text
    • http://jugendfeuerwehr-scheinfeld.de/images/has-momo-hacked-roblox.pdfIn PDF document text
    • https://septik-montag.ru/images/hack-script-copy-and-paste-roblox.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/emotes-roblox-free.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/cheats-para-roblox.pdfIn PDF document text
    • http://swibome.nl/images/roblox-dashing-simulator-hack.pdfIn PDF document text
    • http://www.zdravazena.sk/images/free-robux-giveaway-no-hacks.pdfIn PDF document text
    • http://grabmyinfo.com/images/how-to-get-robux-for-free-without-doing-anything.pdfIn PDF document text
    • http://www.jureclomas.com.ar/images/roblox-2k-hacks.pdfIn PDF document text
    • http://www.peterdejonge.nl/images/hacked-case-clicker-roblox.pdfIn PDF document text
    • http://stroygrad-spb.com/images/roblox-hack-download-explode.pdfIn PDF document text
    • https://www.milewood.co.uk/images/free-roblox-hack-for-ipad.pdfIn PDF document text
    • http://technologicalsc.com/images/free-robux-claim.pdfIn PDF document text
    • https://sectorpravdy.com/images/roblox-hack-free-robux-apk.pdfIn PDF document text
    • http://dream-house.de/images/is-roblox-studio-free.pdfIn PDF document text
    • https://www.devries-group.de/images/roblox-german-flag-t-shirt-free.pdfIn PDF document text
    • http://huananhai.net/images/what-is-free-roblox-generator.pdfIn PDF document text
    • http://www.web.stc-part.co.th/images/roblox-work-at-a-pizza-place-money-hack-2021.pdfIn PDF document text
    +16 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000083df.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x83DF 26752 bytes
SHA-256: 59add9a7ca7ac1a5ef160d12e3472cb99fe2506c02ab6a27f620fe10948a267f
font_01_sfnt_off0000c0f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC0F5 3312 bytes
SHA-256: 40bd8eebcb3a0d68a8646f1930e84f30a44bfa48525263c6c528f0bc1e9c1677
font_02_sfnt_off0000cc44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC44 17608 bytes
SHA-256: dce89bd7f84d74cd55c9db375f90d3327c4b5ea4e93099166c41c0eef12f38f9