Malicious PDF — malware analysis report

Static analysis result for SHA-256 af08b0c7d29b67b0…

MALICIOUS

PDF

254.5 KB Created: 2021-04-05 13:38:03 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: bd7c85269301aa81999f9999f5eeebac SHA-1: e86214d8ecfc2859a2bd3d47bc17cd701cef40e3 SHA-256: af08b0c7d29b67b07bf8c98c12415b1a23e61c2de8745c12a5e430a9f5bdcdc2
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a specific phishing signature related to Roblox. The document contains external URIs pointing to sites offering 'free Roblox scripts' or 'hacks', suggesting a phishing or malware distribution lure. The presence of these URLs and the ClamAV detection strongly indicate an attempt to trick users into downloading potentially harmful content.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3043

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-roblox-military-script PDF link annotation
    • http://meisterhaus-guterl.de/images/hacks-roblox-infinete-jump.pdfIn PDF document text
    • http://e-onlinearchiv.de/images/how-to-get-free-stuff-on-roblox-with-inspect-element.pdfIn PDF document text
    • http://behsanroshd.com/images/roblox-hacks-not-resonding.pdfIn PDF document text
    • https://www.audipec.com.br/images/can-you-get-hacked-on-roblox-when-giving-discord.pdfIn PDF document text
    • http://bi-bordtennis.dk/images/hban-hacks-in-roblox.pdfIn PDF document text
    • http://boliviagasenergia.com/images/free-credit-card-numbers-for-robux.pdfIn PDF document text
    • http://mittlenberg.ch/images/roblox-cheats-and-hacks-no-download.pdfIn PDF document text
    • http://reisebild.eu/images/how-to-know-who-is-hacking-on-roblox-killing-everyone.pdfIn PDF document text
    • http://wsit.at/images/roblox-adopt-me-free.pdfIn PDF document text
    • http://thomas-hartl.at/images/roblox-hack-may-2021.pdfIn PDF document text
    • http://dottgagliardi.com/images/free-robux-withdraw.pdfIn PDF document text
    • https://yarburservices.ru/images/speed-hack-for-every-game-in-roblox.pdfIn PDF document text
    • http://mmech.com/images/is-roblox-free-to-play-on-pc.pdfIn PDF document text
    • https://www.ncscolour.no/images/multiple-roblox-hack.pdfIn PDF document text
    • http://grupodin.com.br/images/roblox-parkour-cheater-tag.pdfIn PDF document text
    • http://beer-holzhaus.ch/images/how-to-get-free-robux-as-a-kid.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/qtx-download-roblox-free.pdfIn PDF document text
    • https://www.u-pin-it.com/images/boombox-backpack-roblox-free.pdfIn PDF document text
    • https://www.ergolight.at/images/rbxrich-free-robux.pdfIn PDF document text
    • https://shimony.net/images/25-robux-for-free.pdfIn PDF document text
    • http://spstrading-th.com/images/roblox-galacxy-cheats.pdfIn PDF document text
    • http://escolaarboc.cat/images/hoodjews-roblox-hack.pdfIn PDF document text
    • http://caraless.com/images/best-game-naruto-all-form-free-roblox.pdfIn PDF document text
    • http://www.guidaturisticaverona.it/images/roblox-hack-version-unlimited-robux.pdfIn PDF document text
    • http://www.art-concept.gr/images/roblox-escape-mcdonalds-free.pdfIn PDF document text
    • https://www.belgium-archery.be/images/how-to-get-free-tix-on-roblox-2021-no-download.pdfIn PDF document text
    • http://pandaplast.com/images/is-it-illegal-to-hack-in-roblox-against-a-streamer.pdfIn PDF document text
    • https://www.lomrad.go.th/images/roblox-egg-farm-simulator-hack.pdfIn PDF document text
    • http://elektrofahrspass.de/images/free-robux-roblox-group.pdfIn PDF document text
    • http://icomsolutions.com.au/images/how-to-get-free-robux-easy-way.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000396e7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x396E7 25516 bytes
SHA-256: dd02801ccadd5e3d30b00680d26db7221c82dee05e2a0f43e95f06e0ae66ede3
font_01_sfnt_off0003d20b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D20B 18324 bytes
SHA-256: 52f7dc13cc93e32bde55b8e1e342cb3d04601201b972410091764ea3e3827343

Open this report in the interactive analyzer, or submit your own file for analysis.