MALICIOUS
72
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file is identified as malicious by ClamAV with the signature Pdf.Phishing.Roblox062100-9873116-0. It contains an embedded URL pointing to a site offering a 'free Robux boost', which is a common lure for phishing or malware distribution. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'free Robux', reinforcing the phishing pretext.
Machine Learning
- Nyx PDF Classifier clean score 0.1052
Heuristics 4
-
ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/free-robux-boost-com PDF link annotation
- http://arcnjournals.org/images/roblox-how-to-get-free-robux-with-cheat-engine-62.pdfIn PDF document text
- https://europe-upkl.eu/images/how-to-hack-roblox-jailbreak-2021-money.pdfIn PDF document text
- https://semanasantacehegin.com/images/free-robux-no-human-verification-and-no-survey.pdfIn PDF document text
- http://global-tech-security.be/images/cheats-for-city-architect-roblox.pdfIn PDF document text
- http://www.compusiteinc.com/images/free-boy-hair-roblox-catalog.pdfIn PDF document text
- http://mittlenberg.ch/images/roblox-cheat-sheet.pdfIn PDF document text
- http://www.mjclautrec.fr/images/how-to-get-free-robux-dec-219.pdfIn PDF document text
- http://abqwinair.com/images/earn-free-robux-by-doing-tasks.pdfIn PDF document text
- http://ehma.com/images/free-robux-and-tix-generator-2021-no-download.pdfIn PDF document text
- http://escolaarboc.cat/images/free-robux-hack-2021-computer.pdfIn PDF document text
- http://wireprod.net/images/free-roblox-accounts-2021-may.pdfIn PDF document text
- https://www.ncscolour.no/images/sunset-coast-gui-roblox-hacks.pdfIn PDF document text
- https://www.utalii.ac.ke/images/free-van-candy-roblox.pdfIn PDF document text
- http://cosver.eu/images/how-to-hack-pokemon-go-roblox.pdfIn PDF document text
- https://www.fhccu.com/images/does-e-free-work-on-roblox.pdfIn PDF document text
- http://cadcam.no/images/how-hack-in-roblox-with-bad-words.pdfIn PDF document text
- http://unc-europe.com/images/hack-apk-roblox-2021.pdfIn PDF document text
- http://www.beantownlimo.com/images/free-face-roblox-2021.pdfIn PDF document text
- http://legitame.org/images/roblox-jailbreak-hack-apk-download.pdfIn PDF document text
- https://jdlgroup.ca/images/free-robux-co-uk.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off000374e7.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x374E7 | 23920 bytes |
SHA-256: ca948e93d0eedc8d57a506419af29c3521c5c747ad128eb4cdfba8f7cdd33f61 |
|||
font_01_sfnt_off0003ab39.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3AB39 | 3884 bytes |
SHA-256: 40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf |
|||
font_02_sfnt_off0003b7e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3B7E1 | 17800 bytes |
SHA-256: 2e9af5e4fea12ee7a89b62e793b9e84f81e23bdec2334a3c8625390c2bfdb98f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.