PDF malware analysis — malicious · b2a00088ca6bf0b1

MALICIOUS

PDF

57.5 KB Created: 2021-04-06 07:27:08 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-24

MD5: 96d856b813a62c9ca81dfa1130274902 SHA-1: ca6ec651305e4af022a85153fb6e096e39e20cbf SHA-256: b2a00088ca6bf0b106469425aed0177d0893c08fa3e1cdb01d84064f0c12c541

90 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. It uses an urgency-based lure. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.7795

Heuristics 5

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://www.dcgsrl.it/images/pastebin-com-free-robux-2021.pdfIn PDF document text
- http://erptrends.com/images/free-coins-roblox.pdfIn PDF document text
- http://bilhetim.com.br/images/make-free-robux-com.pdfIn PDF document text
- https://bancroftandsons.com/images/how-to-get-free-robux-easy-pastebin.pdfIn PDF document text
- https://www.mvp.co.nz/images/roblox-apk-hack-download.pdfIn PDF document text
- http://www.jureclomas.com.ar/images/how-to-get-the-guest-boby-for-free-in-roblox.pdfIn PDF document text
- http://technologicalsc.com/images/how-to-get-25-free-robux.pdfIn PDF document text
- http://onlinemusicsolutions.com.au/images/roblox-apocalypse-rising-script-hack.pdfIn PDF document text
- https://corbo.ru/images/dragon-ball-xenoverse-br-roblox-hack.pdfIn PDF document text
- http://taskcyg.nl/images/free-robux-generator-hack-no-survey.pdfIn PDF document text
- http://instrumenttut.by/images/free-exploits-for-roblox-2021.pdfIn PDF document text
- https://www.albisser.ch/images/best-roblox-jailbreak-hack.pdfIn PDF document text
- https://www.wildpark-johannismuehle.de/images/roblox-robux-hack-2021-may.pdfIn PDF document text
- http://agrupamentoescolas-alfredo-da-silva.com/images/multi-roblox-tabs-hack.pdfIn PDF document text
- https://bgescc.com/images/how-to-get-a-free-skin-in-strucid-roblox.pdfIn PDF document text
- http://domaizdereva24.ru/images/free-robux-no-survey-or-verification-2021.pdfIn PDF document text
- http://www.centromedicoaurora.it/images/roblox-rc7-cracked-free-downlaod.pdfIn PDF document text
- http://aiyta.com/images/roblox-health-hack-cheat-engine-64.pdfIn PDF document text
- https://www.sitiwebjoomla.it/images/hack-para-roblox-robux-gratis-2021.pdfIn PDF document text
- http://portal.crfsp.org.br/images/how-to-hack-un-used-roblox-accounts.pdfIn PDF document text
- https://europe-upkl.eu/images/free-money-in-ultimate-driving-roblox.pdfIn PDF document text
- https://www.acoustiguard.com/images/free-robux-giveaway-access-code.pdfIn PDF document text
- http://dieter-sauter.com/images/actually-free-robux-promo-codes-2021.pdfIn PDF document text
- https://teatrofinisterrae.cl/images/hacking-discord-server-roblox.pdfIn PDF document text
- https://jdlgroup.ca/images/cheat-engine-roblox-robux-hack-2021.pdfIn PDF document text
- http://www.hotelcimone.it/images/free-serverside-roblox.pdfIn PDF document text
- http://s-punkt-objects.de/images/free-robuxs-works.pdfIn PDF document text
- http://unionmusicaldebenidorm.com/images/free-unused-noob-roblox-accounts.pdfIn PDF document text
- https://www.osoc.com/images/robuxian-robux-hack-2021.pdfIn PDF document text
- http://lekarinfo.mk/images/roblox-pokemon-adventures-hack.pdfIn PDF document text
- https://schulzpressetext.de/images/roblox-jeailbreak-hack.pdfIn PDF document text
- http://jwcrownlimo.net/images/free-account-passwords-roblox.pdfIn PDF document text
- http://condit-pack.com/images/roblox-robux-hack-script-jquery.pdfIn PDF document text
- http://bwharrisalumniusa.org/images/free-robux-card-codes-2021.pdfIn PDF document text
- http://a1scan3d.com/images/how-to-get-free-robux-real-2021.pdfIn PDF document text
- http://www.marambio.com.ar/images/free-robux-site-bz.pdfIn PDF document text
- http://interpretation-dessins-enfants.net/images/hack-downlad-roblox.pdfIn PDF document text
- http://www.actae.gr/images/roblox-script-hack-robux-2021.pdfIn PDF document text
- http://bestmaids.co.uk/images/ma-map-roblox-studio-hacker-par.pdfIn PDF document text
- http://www.controverseinterapie.it/images/roblox-azure-mines-cheats-and-codes.pdfIn PDF document text
- http://www.learningbydoinglingue.com/images/roblox-hack-dll-download.pdfIn PDF document text
- https://socialvalue.gr/images/roblox-speed-hack-without-cheat-engine.pdfIn PDF document text
- http://androidthai.in.th/images/dayz-og-roblox-cheat-codes.pdfIn PDF document text
- https://fkg.usu.ac.id/images/roblox-cbro-how-to-get-free-knife.pdfIn PDF document text
- http://www.eurosan1.ba/images/beach-house-roleplay-roblox-hack.pdfIn PDF document text
- https://www.mvp.co.nz/images/when-does-roblox-heroes-online-go-free-release.pdfIn PDF document text
- http://www.maakherumusic.net/images/cheat-cs-go-roblox.pdfIn PDF document text
- http://www.vktzunami.cz/images/free-robux-accounts-2021.pdfIn PDF document text
- http://rivas-treuhand.ch/images/free-csgo-skins-roblox-id.pdfIn PDF document text
+16 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000081ec.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x81EC	25184 bytes
SHA-256: `90e82e03fbf9e1991cccb02b5acc7216cbcb14e295aa1ea334ef7e933b0d1eb1`
`font_01_sfnt_off0000bbf6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBBF6	18688 bytes
SHA-256: `b2a5879e69ef1e6f56096bf3d27c72e62588986aafac3e492ac5c255f53cac1a`

Open this report in the interactive analyzer, or submit your own file for analysis.