Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6982a5078e09674…

MALICIOUS

PDF

56.6 KB Created: 2021-04-05 20:22:40 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 462b0a32b6b789432423f8d3477087e7 SHA-1: 5e747988ec6cca6026b5877a35aa64b34d347e74 SHA-256: a6982a5078e09674110d59cc80251dd71836bdb1bfb6718c3cd06f1b8aa19acd
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous URLs related to Roblox hacks and free Robux, suggesting a lure for users seeking in-game advantages. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document may be instructing users to open a password-protected archive, a common tactic to bypass security filters. The ML classifier also flagged the PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-websites-that-give-free-robux PDF link annotation
    • http://kermas.eu/images/moon-tycoon-roblox-gives-free-robux.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/roblox-free-download-uptodown.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/hack-stats-on-roblox-game.pdfIn PDF document text
    • https://www.lomrad.go.th/images/free-robux-june-2021.pdfIn PDF document text
    • http://stackideas.com/images/free-roblox-gift-card-codes-2021.pdfIn PDF document text
    • http://ff-obertraun.at/images/how-to-ban-or-kick-in-servers-roblox-hack-script.pdfIn PDF document text
    • https://www.abrapppe.org.br/images/roblox-free-military-clothes.pdfIn PDF document text
    • https://bancroftandsons.com/images/roblox-destruction-simulator-hack.pdfIn PDF document text
    • https://www.porthos.it/images/free-and-easy-robux.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/roblox-hack-scripts-non-virus.pdfIn PDF document text
    • https://pagadder.com/images/roblox-lumber-tycoon-2-cheat-axe.pdfIn PDF document text
    • https://pagadder.com/images/roblox-moon-tycoon-hack.pdfIn PDF document text
    • https://www.cnte.org.br/images/how-to-change-my-roblox-username-for-free.pdfIn PDF document text
    • http://bilhetim.com.br/images/free-roblox-account-dantdm.pdfIn PDF document text
    • https://www.bmta.co.uk/images/free-robux-obby-meaining.pdfIn PDF document text
    • http://behsanroshd.com/images/roblox-cheat-2021.pdfIn PDF document text
    • http://www.torvet11.dk/images/how-to-get-free-robux-without-surveys-2021.pdfIn PDF document text
    • http://legs11.co.za/images/free-roblox-shoulder-pets.pdfIn PDF document text
    • http://keepcasscountybeautiful.com/images/greenlegocats123-how-to-get-free-robux.pdfIn PDF document text
    • http://echosvoix.ch/images/how-to-change-my-roblox-name-for-free.pdfIn PDF document text
    • http://pourvosvacances.com/images/free-roblox-toys-redeem-codes-2021.pdfIn PDF document text
    • http://www.visiblefilm.com/images/easy-roblox-hack-2021.pdfIn PDF document text
    • http://ff-obertraun.at/images/free-robux-eith-no-verifications.pdfIn PDF document text
    • https://www.alu-as.cz/images/how-to-hack-someones-roblox-account-2021.pdfIn PDF document text
    • http://aiyta.com/images/free-1-word-roblox-usernames-generator.pdfIn PDF document text
    • http://picuruta.com.br/images/how-to-hack-on-stage-in-roblox-rap-battles.pdfIn PDF document text
    • https://sitam.co.in/images/roblox-bee-game-hack-to-play.pdfIn PDF document text
    • https://corbo.ru/images/free-building-games-on-roblox.pdfIn PDF document text
    • http://kfz-ilg.com/images/apps-that-can-hack-roblox.pdfIn PDF document text
    • http://jobsy.com.sg/images/how-do-you-hack-other-players-account-on-roblox.pdfIn PDF document text
    • http://www.imperialaccountingfl.com/images/roblox-hack-executor.pdfIn PDF document text
    • http://caraless.com/images/roblox-hacks-no-servays.pdfIn PDF document text
    • http://unilin21.ru/images/how-to-get-free-robux-legit-filmz.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/fishing-glitch-gives-free-robux.pdfIn PDF document text
    • http://ilcommercialista.info/images/how-to-hack-roblox-2021-cheat-engine.pdfIn PDF document text
    • http://instrumenttut.by/images/roblox-admin-hack-download.pdfIn PDF document text
    • http://kids-academy.pl/images/roblox-free-glasses.pdfIn PDF document text
    • http://forsazh-51.ru/images/roblox-high-school-life-free-stuff.pdfIn PDF document text
    • http://ns1.radiofacil.net/images/roblox-execiter-hack.pdfIn PDF document text
    • http://www.mikramarine.gr/images/roblox-ww2-cheats.pdfIn PDF document text
    • http://nikabio.com/images/ways-to-get-robux-free.pdfIn PDF document text
    • http://sbm-nn.ru/images/roblox-jailbreak-btools-hack-2021.pdfIn PDF document text
    • http://aistplus.ru/images/adopt-me-roblox-play-for-free.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/free-2021-roblox-accounts.pdfIn PDF document text
    • http://iluvlocalplaces.com/images/how-to-get-free-pants-on-roblox-2021.pdfIn PDF document text
    • https://meltonschool.org/images/roblox-shinobi-story-cheats.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/how-to-hack-on-roblox-rap-battles-2021.pdfIn PDF document text
    • http://grupodin.com.br/images/how-to-speed-hack-roblox-2021.pdfIn PDF document text
    • http://studentslovetravel.com/images/really-free-robux.pdfIn PDF document text
    +13 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000080ab.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x80AB 24868 bytes
SHA-256: db9ccf9bea1854588f0cc8364a21381814755abde7ba50a3a0148452b5314aa5
font_01_sfnt_off0000b96e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB96E 18444 bytes
SHA-256: 8ee21d202f200bc72b2b8829c7f2756a1d06b67f2172d2506bab21af5ecea70e

Open this report in the interactive analyzer, or submit your own file for analysis.