Malicious PDF — malware analysis report

Static analysis result for SHA-256 afc0c18d47644227…

MALICIOUS

PDF

250.8 KB Created: 2021-04-04 10:27:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 5539830c272d0a172dce8faa412f332b SHA-1: 6de936f17349af0b6f1e889765a3487a1ec8504e SHA-256: afc0c18d476442278466289f61ccf463bdc89b506d80d79677b17d1740f7d0d7
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a specific phishing signature related to Roblox. The document body, though heavily obfuscated, contains references to 'Roblox' and 'Robux', and a critical heuristic identified an external URI pointing to a website offering 'how to get robux in roblox cheat'. This strongly suggests a phishing or scam attempt aimed at Roblox players.

Machine Learning

  • Nyx PDF Classifier clean score 0.1227

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-get-robux-in-roblox-cheat PDF link annotation
    • http://bilhetim.com.br/images/comment-hacker-des-gens-sur-roblox.pdfIn PDF document text
    • http://www.zdravazena.sk/images/free-roblox-tshirts.pdfIn PDF document text
    • http://haertetechnik-steinbach.de/images/roblox-money-cheat-2021.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/hacker-roblox-id-code.pdfIn PDF document text
    • http://aiyta.com/images/free-robux-offerwalls.pdfIn PDF document text
    • https://www.hotschool.com.au/images/how-to-get-free-robux-nicsterv.pdfIn PDF document text
    • http://www.teapotjewelry.com/images/how-to-get-free-stuff-in-roblox-dragon-riders.pdfIn PDF document text
    • http://vipservice-bg.com/images/hack-any-roblox-robux.pdfIn PDF document text
    • http://force-seniorklub.dk/images/get-20210-robux-on-roblox-free.pdfIn PDF document text
    • https://gastroration.ru/images/roblox-robux-editor-hack-download.pdfIn PDF document text
    • https://arcasict.nl/images/how-to-hack-roblox-prison-life-v2-02.pdfIn PDF document text
    • http://www.prylfabriken.se/images/free-black-hair-roblox.pdfIn PDF document text
    • https://www.lavigny.ch/images/how-to-look-like-a-hacker-in-roblox-for-free.pdfIn PDF document text
    • http://cadcam.no/images/roblox-hack-how-to-get-free-robux-on-android-amp.pdfIn PDF document text
    • http://s-punkt-objects.de/images/roblox-before-the-dawn-cheats.pdfIn PDF document text
    • http://www.isril.it/images/avatar-roblox-skin-free.pdfIn PDF document text
    • http://schrichte.de/images/roblox-speed-client-hack-2021.pdfIn PDF document text
    • http://alexandrion.com/images/free-robux-apple-mac.pdfIn PDF document text
    • http://goldwing-shop.ru/images/bomb-hair-salon-roblox-no-hacks.pdfIn PDF document text
    • https://hbpbenin.com/images/how-to-get-free-robux-august-2021.pdfIn PDF document text
    • http://ghegamethu.vn/images/how-to-hack-roblox-murder-mystery-2.pdfIn PDF document text
    • http://nosocomium.rv.ua/images/how-to-hack-gta-car-game-on-roblox-mobile.pdfIn PDF document text
    • https://beejekorf.nl/images/robux-generatr-hack-2021.pdfIn PDF document text
    • http://icomsolutions.com.au/images/how-to-get-free-stuff-on-roblox-with-codes.pdfIn PDF document text
    • https://www.olboys.it/images/roblox-injector-pc-free.pdfIn PDF document text
    • https://www.foodsafety.cz/images/hack-wekk-roblox.pdfIn PDF document text
    • http://petarda.hu/images/roblox-how-to-get-stuff-for-free.pdfIn PDF document text
    • http://swibome.nl/images/how-to-get-r-in-roblox-free.pdfIn PDF document text
    • http://www.arredifunebri.com/images/free-diamonds-roblox-royale-high.pdfIn PDF document text
    • https://yarburservices.ru/images/roblox-robux-cards-free.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off00038e97.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x38E97 23384 bytes
SHA-256: 0f15b823f6df866920d065eaee347dab6f282e13a85207ab0006e7055ae1aba5
font_01_sfnt_off0003c370.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C370 17824 bytes
SHA-256: 51d5397c7c1eadeedad6583470fb34aea36b2cf6fd5dcd92c1ad4bbf0862dd49

Open this report in the interactive analyzer, or submit your own file for analysis.