PDF malware analysis — malicious · b1f0c00bbd56a17c

MALICIOUS

PDF

53.1 KB Created: 2021-04-06 18:00:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24

MD5: 203bc4f1217cfec246b6824db820bbb2 SHA-1: 2cb02a957a14d24ffbf3a7e91a9fa8658741295b SHA-256: b1f0c00bbd56a17c74039c9d15f1e4a78f339334363b4f2ff9cdd477fec905ea

142 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains multiple links disguised as game hacks and free currency generators, specifically targeting Roblox players. The heuristic 'PDF_GAME_HACK_REDIRECT_LURE' and the ML classifier strongly indicate malicious intent. The embedded links likely lead to phishing sites or download further malicious content, aligning with a common social engineering tactic.

Machine Learning

Nyx PDF Classifier malicious score 0.8721

Heuristics 5

PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- https://www.arquetopia.org/images/hack-pour-avoir-des-robux-facilemen-2021.pdfIn PDF document text
- http://ff-obertraun.at/images/how-to-hack-in-the-void-booga-booga-roblox.pdfIn PDF document text
- http://ordineavvocatitempio.it/images/goo-dot-gl-hnkqwp-replace-dot-with-free-robux.pdfIn PDF document text
- http://armatrutz.de/images/free-robux-no-verification-no-download-2021.pdfIn PDF document text
- https://www.hbproducts.dk/images/do-you-get-free-robux-with-builders-club-2021-bonus.pdfIn PDF document text
- http://www.sitiamministrabili.it/images/get-500k-robux-free.pdfIn PDF document text
- http://adenmarks.se/images/free-roblox-vip-server-for-lab-experiment.pdfIn PDF document text
- https://laconce.com/images/how-to-get-free-robux-easy-2021-on-ipad.pdfIn PDF document text
- http://cmfd.nl/images/roblox-dragon-ball-rage-stats-hack-site-v3rmillionnet.pdfIn PDF document text
- http://gestibrok.com/images/free-robux-hack-no-huan-verification.pdfIn PDF document text
- http://j-cook.pro/images/the-easiest-way-to-get-free-robux.pdfIn PDF document text
- https://www.coriglianocalabro.it/images/free-free-robux-game.pdfIn PDF document text
- http://harmonygardens.ca/images/roblox-snow-shoveling-simulator-free-santa-bag-inf.pdfIn PDF document text
- https://kimolos-link.gr/images/roblox-terminal-railways-free-trains.pdfIn PDF document text
- http://www.adravietnam.org/images/discord-free-robux.pdfIn PDF document text
- http://www.exikom.com.ua/images/roblox-kohls-admin-hack.pdfIn PDF document text
- http://agrupamentoescolas-alfredo-da-silva.com/images/free-account-on-roblox-with-obc.pdfIn PDF document text
- https://ccej.lviv.ua/images/how-to-get-free-robux-using-cmd.pdfIn PDF document text
- http://korporacjaroma.pl/images/admin-free-robux.pdfIn macro / runtime command snippet
- http://www.conservatoriolecce.it/images/legit-how-to-get-free-robux.pdfIn macro / runtime command snippet
- https://reggieslockandkey.com/images/free-shirt-roblox-youtube.pdfIn macro / runtime command snippet
- http://nikabio.com/images/roblox-mod-hack-apk.pdfIn PDF document text
- http://cosver.eu/images/how-to-hack-a-computer-in-roblox-flee-the-facility.pdfIn PDF document text
- http://adues.org/images/roblox-booga-booga-hack-mojo-update.pdfIn PDF document text
- http://grand-ural74.ru/images/free-clothes-on-roblox-no-builders-club.pdfIn PDF document text
- https://verdensbarn.no/images/free-robux-from-roblox-admins-real.pdfIn PDF document text
- http://d-loft.com.tr/images/cheat-engine-roblox-youtube.pdfIn PDF document text
- http://daksz.hu/images/roblox-free-dominus-generator.pdfIn PDF document text
- https://enpav.it/images/how-to-get-free-robux-in-roblox-2021-proof.pdfIn PDF document text
- http://safeandsecurelocksmith.ca/images/roblox-martial-arts-bo-hacking-with-cheat-engine.pdfIn PDF document text
- http://5346000.com/images/free-unlimited-money-on-roblox-pool-tycoon-4.pdfIn PDF document text
- http://archi-z.ru/images/roblox-kicking-hack.pdfIn PDF document text
- https://www.cpnf.ch/images/how-to-be-vip-on-roblox-for-free.pdfIn PDF document text
- http://businessmart.ro/images/roblox-mad-murderer-hack.pdfIn PDF document text
- https://www.foodsafety.cz/images/free-clothes-giveaway-online-roblox.pdfIn PDF document text
- http://eastwestmacrobiotics.com/images/roblox-highschool-cheats.pdfIn PDF document text
- http://joshherman.com/images/free-robux-that-actually-work-2021-not-banned.pdfIn PDF document text
- http://www.maakherumusic.net/images/free-roblox-accounts-with-obc-lifetime-2021.pdfIn PDF document text
- http://taskcyg.nl/images/btools-roblox-hack-2021.pdfIn PDF document text
- http://petarda.hu/images/roblox-prison-life-hack-2021.pdfIn PDF document text
- http://gods-own.org/images/free-roblox-premium.pdfIn PDF document text
- http://www.hawler.in/images/roblox-prison-life-v20-hack-2021.pdfIn PDF document text
- http://akademiatenisa.org/images/script-for-free-robux-vid.pdfIn PDF document text
- http://buvis.is/images/roblox-jailbreak-glitch-through-walls-hack.pdfIn PDF document text
- http://pdapanache.com/images/free-robux-hack-2021.pdfIn PDF document text
- https://jsgwertherborgholzhausen.de/images/how-to-send-a-trade-on-roblox-free.pdfIn PDF document text
- http://ce-tsv-nantes.fr/images/free-supreme-roblox-modek.pdfIn PDF document text
- http://caraless.com/images/roblox-gear-hack-script-pastebin.pdfIn PDF document text
- http://jaeger-bauplanung.de/images/robux-hack-2021-on-phone.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006e23.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6E23	25956 bytes
SHA-256: `e39283fb6ea21e460f747b0b73fb4cd040ba9dd3f46b979ffb9a29c985471370`
`font_01_sfnt_off0000a97b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA97B	18972 bytes
SHA-256: `638e71717626b55695f959145576c192f8a1632ca4fc2ff5ca957fd35394e5d0`

Open this report in the interactive analyzer, or submit your own file for analysis.