Malicious PDF — malware analysis report

Static analysis result for SHA-256 b43fa9d0dc392e7a…

MALICIOUS

PDF

248.5 KB Created: 2021-04-05 01:31:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 030f4b18d96960daf4f689af55a05674 SHA-1: 40559627fa8454610c4f6c6b522075512cfbb734 SHA-256: b43fa9d0dc392e7abfc01ebcf014e9b57826bc4e78101f489558cdf54f4b1f2e
112 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Pdf.Phishing.Roblox062100-9873116-0. The document contains heuristics indicating it's a lure to execute commands via clipboard content, likely to download a second-stage payload from the embedded URL http://gaminggenerator.org/app/431946152/lien-de-hack-money-pour-mad-city-roblox-seson-3. The document body, though heavily obfuscated, contains references to 'Roblox' and 'hack money', suggesting a scam targeting gamers.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2693

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/lien-de-hack-money-pour-mad-city-roblox-seson-3 PDF link annotation
    • http://www.visiblefilm.com/images/earn-free-roblox-gift-cards-legit.pdfIn PDF document text
    • http://hindicenter.com/images/roblox-high-school-money-hack-2021.pdfIn PDF document text
    • http://beer-holzhaus.ch/images/how-to-hack-someone-on-roblox-ipad.pdfIn PDF document text
    • http://dos.most.gov.la/images/www-blox-land-free-robux.pdfIn PDF document text
    • http://karolinaherrera.com/images/roblox-treelands-free-uncopylock.pdfIn PDF document text
    • https://www.gvandenakker.nl/images/roblox-hack-bss.pdfIn PDF document text
    • https://www.fenews.co.uk/images/get-knife-hack-in-roblox-cheat-engine.pdfIn PDF document text
    • http://rumler.pl/images/roblox-broken-bones-iv-cheats.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/free-robux-click-the-button.pdfIn PDF document text
    • https://waterpark.by:443/images/gain-blox-2021-free-robux-inspect.pdfIn PDF document text
    • http://businessfit.com/images/bux-gg-robux-free.pdfIn PDF document text
    • http://nevesomost.by/images/how-to-get-robux-easily-and-free.pdfIn PDF document text
    • https://pemadamapi.net/images/roblox-hack-apk-pc-download.pdfIn PDF document text
    • http://www.mediaxin.net/images/cheat-mine-simulateur-roblox.pdfIn PDF document text
    • https://reggieslockandkey.com/images/roblox-jailbreak-free-robux.pdfIn PDF document text
    • https://hassel-event.de/images/roblox-com-free-robux-hack.pdfIn PDF document text
    • http://clubpure.org/images/free-robux-link-game-by-roblox.pdfIn PDF document text
    • https://xn--80adfcepoood1a3b.xn--p1ai/images/roblox-free-robux-download-2021.pdfIn PDF document text
    • https://www.knxuk.org/images/how-to-hack-points-on-roblox.pdfIn PDF document text
    • http://teksomak.com/images/mobihack-net-roblox-hack.pdfIn PDF document text
    • http://CPat-Shop.deIn PDF document text
    • https://twitterIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00037e22.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37E22 25184 bytes
SHA-256: 9c8e949ebac1f2501ce160a975f26c1f39e7ddf8447c2d53faaae1420945db64
font_01_sfnt_off0003b83d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B83D 19316 bytes
SHA-256: fb9d4fb88b285089778e7619acbcd6dd6925ff0a566af05aab5e933f4264ad5c

Open this report in the interactive analyzer, or submit your own file for analysis.