Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac8c6a39ffaa490a…

MALICIOUS

PDF

61.3 KB Created: 2021-04-05 18:09:34 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 59a64024a4c80568c7313fa446107ede SHA-1: 5682602afa7531e8001c755fb9a8902b024be3c5 SHA-256: ac8c6a39ffaa490a9d5a2f61f7d476ee6e3198f1cd1d57a14d20590d666f82b9
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to websites that promise free Robux or game hacks, indicating a scam or phishing attempt. The heuristic firings, particularly 'PDF_GAME_HACK_SEO_LINK_FARM', strongly support this conclusion. While no scripts were directly extracted, the document's structure and embedded URLs suggest it's designed to redirect users to malicious sites, likely as part of a broader phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-get-robux-for-free-2021 PDF link annotation
    • http://rumler.pl/images/free-virtual-code-roblox.pdfIn PDF document text
    • https://www.hotschool.com.au/images/best-roblox-shirt-maker-for-free.pdfIn PDF document text
    • http://armportal.co.uk/images/btools-hack-script-roblox.pdfIn PDF document text
    • http://itbits.ie/images/roblox-hack-twisted-murderer.pdfIn PDF document text
    • https://www.banhngoncaocap.com/images/how-to-get-free-admin-on-roblox-2021.pdfIn PDF document text
    • http://avd-weiden.bayern/images/hacks-for-roblox-script.pdfIn PDF document text
    • http://arpinoturismo.it/images/filled-surveys-for-free-robux.pdfIn PDF document text
    • http://dream-house.de/images/hack-roblox-flood-escape-2.pdfIn PDF document text
    • http://dream-house.de/images/free-roblox-toy-redeem-code.pdfIn PDF document text
    • http://www.backlineservice.nl/images/roblox-cheat-free-download.pdfIn PDF document text
    • http://www.imwd.it/images/kranberry-roblox-hack-download.pdfIn PDF document text
    • http://www.hotelcomelico.it/images/how-to-hack-rabbit-simulaator-2-on-roblox.pdfIn PDF document text
    • http://elearnfactory.com/images/free-robux-codes-2021-october.pdfIn PDF document text
    • https://luminouswisdom.org/images/dragon-ball-after-future-roblox-hack.pdfIn PDF document text
    • http://briankellyforcongress.com/images/cheat-indetectable-roblox-fly.pdfIn PDF document text
    • http://schottlandfieber.de/images/using-free-purchases-on-roblox.pdfIn PDF document text
    • http://www.rezbb.sk/images/admin-panel-free-robux.pdfIn PDF document text
    • http://schrichte.de/images/roblox-dinosaur-simulator-free.pdfIn PDF document text
    • https://www.stoehr-sauer.de/images/op-wii-roblox-cheat.pdfIn PDF document text
    • http://webstan.be/images/cool-free-clothes-on-roblox.pdfIn PDF document text
    • https://sectorpravdy.com/images/pastebin-hack-for-robux.pdfIn PDF document text
    • https://gomsa.nl/images/cheat-engine-63-roblox-download.pdfIn PDF document text
    • https://www.audev.com/images/free-robux-generator-club.pdfIn PDF document text
    • http://innovativefs.co.uk/images/free-lua-roblox-exploit.pdfIn PDF document text
    • http://infoagronomia.com.ar/images/veos-fun-roblox-hack.pdfIn PDF document text
    • http://moringaforlove.com/images/roblox-hack-tool-no-verification.pdfIn PDF document text
    • https://www.seeingindependence.org/images/how-to-hack-roblox-robux-2021.pdfIn PDF document text
    • http://properteez.com/images/best-roblox-hack-executer.pdfIn PDF document text
    • http://xn----7sbabhw4a8b0addm1c.xn--p1ai/images/hacker-roblox-games.pdfIn PDF document text
    • http://feuerwehr-rheinau.de/images/are-there-any-obbies-that-give-free-robux.pdfIn PDF document text
    • http://eddegrootassurantien.nl/images/como-hackear-robux-rapido.pdfIn PDF document text
    • http://dottgagliardi.com/images/roblox-csgo-free.pdfIn PDF document text
    • http://gitagasht.com/images/free-roblox-usernames.pdfIn PDF document text
    • http://engelum.com/images/roblox-continue-as-a-guest-for-free.pdfIn PDF document text
    • http://imp.lg.ua/images/how-to-hack-roblox-for-robux-no-human-verification.pdfIn PDF document text
    • http://alexanderautos.co/images/is-it-illegal-to-hack-robux.pdfIn PDF document text
    • http://www.fvsspa.com/images/robux-hack-without-downloading-stuff.pdfIn PDF document text
    • http://ottawavalleykitchens.ca/images/appsmob-info-roblox-hack.pdfIn PDF document text
    • http://cmfd.nl/images/free-robux-generator-no-download.pdfIn PDF document text
    • https://www.saisystem.it/images/muscle-simulator-roblox-cheat.pdfIn PDF document text
    • http://moralcenter.or.th/images/how-to-hack-roblox-group-ranks.pdfIn PDF document text
    • http://www.bois-ariegeois.fr/images/hack-roblox-speed-hack.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/how-hack-people-item-in-roblox.pdfIn PDF document text
    • http://shinarb.by/images/roblox-green-hair-free.pdfIn PDF document text
    • http://omahahospitalityhalloffame.org/images/hack-my-account-password-roblox.pdfIn PDF document text
    • http://axia-verlag.at/images/howto-get-free-robux-2021.pdfIn PDF document text
    • https://www.u-pin-it.com/images/roblox-speed-hack-dll.pdfIn PDF document text
    • http://acp-institut.fr/images/how-to-get-free-robux-on-android-no-human-verification.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/how-to-get-free-cars-in-roblox-jailbreak.pdfIn PDF document text
    +9 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000814e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x814E 29188 bytes
SHA-256: 749fe253713ea523688d8902e560e9a23bcd8d5d5662c4a8b373968ce7c661ca
font_01_sfnt_off0000c351.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC351 2832 bytes
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2
font_02_sfnt_off0000cd01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD01 17916 bytes
SHA-256: e541f8a4b0809e31839d29af1d106629a930a7bb0b2cbf4933e14c309eccc37a