Malicious PDF — malware analysis report

Static analysis result for SHA-256 acb33c8ef673e5e8…

MALICIOUS

PDF

52.0 KB Created: 2021-04-06 16:29:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: f3da122415dad03d75c0e2de43f728eb SHA-1: 8f1c65eb2ad3d733c13daf0ab8835d8d36f80fe7 SHA-256: acb33c8ef673e5e8843766d45e28f1aa568f9fad0dd2f409d506b864f048f934
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple lures related to 'Roblox hacks' and 'free Robux', directing users to external URLs. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates the document likely prompts users to install something, which is a common tactic for malware delivery or credential harvesting. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8896

Heuristics 5

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • https://itv-grabungen.de/images/free-robux-2021-xtill-working.pdfIn PDF document text
    • https://belixconstructions.com.au/images/working-robux-pastebin-hack.pdfIn PDF document text
    • https://www.foodsafety.cz/images/muffin-kombat-roblox-hack-pastebin.pdfIn PDF document text
    • http://fiur-malermeister.de/images/free-robux-without-human-verification-website.pdfIn PDF document text
    • https://www.lomrad.go.th/images/free-robux-codes-adopt-me.pdfIn PDF document text
    • https://www.lavigny.ch/images/free-roblox-card-codes-no-download.pdfIn PDF document text
    • https://www.yewtreealpacas.co.uk/images/how-to-get-robux-and-tix-for-free-on-roblox.pdfIn PDF document text
    • http://soma.com.ua/images/how-to-make-free-private-servers-on-roblox.pdfIn PDF document text
    • http://ivanflores.cl/images/how-to-get-free-old-roblox-accounts.pdfIn PDF document text
    • http://cosver.eu/images/robux-hack-no-verification-at-all.pdfIn PDF document text
    • http://ladagoterie.fr/images/roblox-how-to-get-a-free-dominus.pdfIn PDF document text
    • http://kovroff.com.ua/images/november-2021-torso-cheat-jailbreak-roblox.pdfIn PDF document text
    • http://pielab.gr/images/free-boombox-on-roblox-script-pastebin.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/roblox-banning-simulator-hack-download.pdfIn PDF document text
    • http://subarulegacy.com/images/is-the-game-robux-hacked.pdfIn PDF document text
    • http://legs11.co.za/images/robux-hack-on-apple-computer.pdfIn PDF document text
    • http://darruzzo.com/images/level-7-roblox-free.pdfIn PDF document text
    • http://aiyta.com/images/coin-hack-for-assassain-roblox.pdfIn PDF document text
    • http://jobsy.com.sg/images/free-robux-generator-com-oprewards.pdfIn PDF document text
    • https://leckeres-geschenk.de/images/can-you-make-shirts-free-on-roblox.pdfIn PDF document text
    • http://lichtdrukkerijwijchen.nl/images/roblox-adopt-me-hacks-2021.pdfIn PDF document text
    • http://www.pacoestrada.it/images/free-synapse-key-roblox.pdfIn PDF document text
    • http://seytarehco.com/images/roblox-hack-money-2021.pdfIn PDF document text
    • https://www.air-shop.cz/images/counter-blox-roblox-offensive-hacks-download.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/roblox-cheat-forum.pdfIn PDF document text
    • https://www.apollowebdesign.in/images/hack-pour-recuperer-son-conte-roblox.pdfIn PDF document text
    • http://garrisonjazz.com/images/roblox-promocodes-with-free-robux.pdfIn PDF document text
    • https://www.millatgears.com/images/free-hiring-scripters-roblox.pdfIn PDF document text
    • https://www.lavigny.ch/images/robux-hack-without-human-verification-and-survey.pdfIn PDF document text
    • http://iprep-u.com/images/best-free-alternatives-to-roblox.pdfIn PDF document text
    • http://shahriyarclimb.com/images/hack-the-plaza-beta-on-roblox.pdfIn PDF document text
    • http://traveltrucks.com.au/images/roblox-hack-free-skins.pdfIn PDF document text
    • http://chartsmart.com.au/images/royalty-free-music-one-sirius-beats-roblox-id.pdfIn PDF document text
    • http://gamixpaliwa.pl/images/javascript-roblox-robux-hack.pdfIn PDF document text
    • http://properteez.com/images/roblox-how-to-get-unlimited-free-robox-2021.pdfIn PDF document text
    • http://possumholler.us/images/oprewards-get-free-robux.pdfIn PDF document text
    • https://www.cnte.org.br/images/roblox-cheat-commands.pdfIn PDF document text
    • http://ghegamethu.vn/images/free-robux-inspect-no-waiting.pdfIn PDF document text
    • http://piadaandco.it/images/01-know-this-free-robux-secret.pdfIn PDF document text
    • http://www.beged.at/images/redeem-card-2021-robux-free.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/become-a-hacker-in-roblox.pdfIn PDF document text
    • http://verenacrow.at/images/how-to-get-free-in-catalog-roblox.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/lego-roblox-hacking.pdfIn PDF document text
    • https://gafaseo.com/images/working-robux-pastebin-hack.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/games-on-roblox-that-give-you-real-free-robux.pdfIn PDF document text
    • http://fairwaygolftravel.co.uk/images/free-roblox-accounts-with-robux-2021-that-work.pdfIn PDF document text
    • http://www.awakeningtruth.org/images/how-to-get-free-robux-easy-ads.pdfIn PDF document text
    • http://grahambettsmotors.com/images/roblox-redeem-codes-free.pdfIn PDF document text
    • http://traveltrucks.com.au/images/roblox-jail-break-noclip-hack.pdfIn PDF document text
    +14 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006e8b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6E8B 25476 bytes
SHA-256: e1b9d0a99c3e374fa5f8904f1ea70138ac2f2cb087eaaee6e00d16c32a9ba2e7
font_01_sfnt_off0000a8d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA8D9 17792 bytes
SHA-256: 7568c00a9530f007c23acc05a40a631364b0dafc5a3ca380b8a188fbb8e5f14b