Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2299ea938eff2d4…

MALICIOUS

PDF

247.3 KB Created: 2021-04-05 05:13:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 415fccb8bf0c73817cfaa8609de71eb0 SHA-1: 71d8bd9b0b1c269b2938156fc3ddb6866ce72fdf SHA-256: b2299ea938eff2d42fdc5e47344001f84bc397e83e650f369a9903bede95ab75
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature Pdf.Phishing.Roblox062100-9873116-0. It contains an embedded URL pointing to a site offering a 'free Robux boost', which is a common lure for phishing or malware distribution. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'free Robux', reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier clean score 0.1052

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-robux-boost-com PDF link annotation
    • http://arcnjournals.org/images/roblox-how-to-get-free-robux-with-cheat-engine-62.pdfIn PDF document text
    • https://europe-upkl.eu/images/how-to-hack-roblox-jailbreak-2021-money.pdfIn PDF document text
    • https://semanasantacehegin.com/images/free-robux-no-human-verification-and-no-survey.pdfIn PDF document text
    • http://global-tech-security.be/images/cheats-for-city-architect-roblox.pdfIn PDF document text
    • http://www.compusiteinc.com/images/free-boy-hair-roblox-catalog.pdfIn PDF document text
    • http://mittlenberg.ch/images/roblox-cheat-sheet.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/how-to-get-free-robux-dec-219.pdfIn PDF document text
    • http://abqwinair.com/images/earn-free-robux-by-doing-tasks.pdfIn PDF document text
    • http://ehma.com/images/free-robux-and-tix-generator-2021-no-download.pdfIn PDF document text
    • http://escolaarboc.cat/images/free-robux-hack-2021-computer.pdfIn PDF document text
    • http://wireprod.net/images/free-roblox-accounts-2021-may.pdfIn PDF document text
    • https://www.ncscolour.no/images/sunset-coast-gui-roblox-hacks.pdfIn PDF document text
    • https://www.utalii.ac.ke/images/free-van-candy-roblox.pdfIn PDF document text
    • http://cosver.eu/images/how-to-hack-pokemon-go-roblox.pdfIn PDF document text
    • https://www.fhccu.com/images/does-e-free-work-on-roblox.pdfIn PDF document text
    • http://cadcam.no/images/how-hack-in-roblox-with-bad-words.pdfIn PDF document text
    • http://unc-europe.com/images/hack-apk-roblox-2021.pdfIn PDF document text
    • http://www.beantownlimo.com/images/free-face-roblox-2021.pdfIn PDF document text
    • http://legitame.org/images/roblox-jailbreak-hack-apk-download.pdfIn PDF document text
    • https://jdlgroup.ca/images/free-robux-co-uk.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000374e7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x374E7 23920 bytes
SHA-256: ca948e93d0eedc8d57a506419af29c3521c5c747ad128eb4cdfba8f7cdd33f61
font_01_sfnt_off0003ab39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3AB39 3884 bytes
SHA-256: 40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf
font_02_sfnt_off0003b7e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B7E1 17800 bytes
SHA-256: 2e9af5e4fea12ee7a89b62e793b9e84f81e23bdec2334a3c8625390c2bfdb98f