PDF malware analysis — malicious · b66afe223d6691ea

MALICIOUS

PDF

58.2 KB Created: 2021-04-05 20:59:51 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-24

MD5: 551d7a19ba1899b850982f889d3dc314 SHA-1: 0d5986754a3677b0156dee491d7784312d23e843 SHA-256: b66afe223d6691ea3f75036d7151195d649badab33d60c92ff24fd707f0eee4b

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF document was flagged as malicious by an ML classifier. It uses a fake browser/software-install lure. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.7795

Heuristics 4

Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/roblox-hack-tool-download-android PDF link annotation
- http://nosocomium.rv.ua/images/how-to-get-gear-in-roblox-free-admin.pdfIn PDF document text
- https://www.utalii.ac.ke/images/adopt-me-roblox-hack-script.pdfIn PDF document text
- http://pa-tanjungselor.go.id/images/free-codes-for-assassin-roblox.pdfIn PDF document text
- http://altc.de/images/roblox-cheat-engine-health-hack.pdfIn PDF document text
- http://www.htc.edu.au/images/roblox-hack-free-download.pdfIn PDF document text
- https://rincondelentrenador.com/images/how-to-get-free-robux-hack-on-computer.pdfIn PDF document text
- http://jointworkstudio.com/images/when-will-heroes-online-be-free-roblox.pdfIn PDF document text
- https://gaj.rs/images/roblox-hack-accont.pdfIn PDF document text
- https://www.audev.com/images/how-to-cheat-to-get-robux-on-roblox.pdfIn PDF document text
- http://eau-petit-pont.com/images/dominus-rex-roblox-free.pdfIn PDF document text
- https://treeconsult.de/images/tool4u-vip-ff-hack-roblox.pdfIn PDF document text
- http://bkd1.balikpapan.go.id/images/shirts-for-roblox-free-shipping.pdfIn PDF document text
- http://petarda.hu/images/codes-to-hack-roblox-accounts.pdfIn PDF document text
- http://sscclc.edu.ec/images/free-stuff-roblox-obby.pdfIn PDF document text
- http://ckac.com.sg/images/15-robux-free.pdfIn PDF document text
- https://www.nema.go.ke/images/get-free-roblox-money.pdfIn PDF document text
- http://force-seniorklub.dk/images/free-roblox-accounts-with-robux.pdfIn PDF document text
- http://act.gr/images/how-to-get-in-peoples-roblox-account-without-hacking.pdfIn PDF document text
- http://eleveurs-autrement.fr/images/robux-hack-generator.pdfIn PDF document text
- https://www.seeingindependence.org/images/como-usar-hacks-en-booga-booga-roblox.pdfIn PDF document text
- http://kids-academy.pl/images/como-descargar-hack-para-en-roblox.pdfIn PDF document text
- http://xn--hrtetechnik-steinbach-51b.de/images/free-admin-hack-for-roblox.pdfIn PDF document text
- http://www.boic.nl/images/hack-roblox-lumber-tycoon2.pdfIn PDF document text
- http://dorfgaragethalwil.ch/images/how-to-get-free-robux-using-inspect.pdfIn PDF document text
- http://technologicalsc.com/images/hack-tycoon-money-roblox.pdfIn PDF document text
- http://ernstgloves.co.il/images/money-hack-roblox-jailbreak.pdfIn PDF document text
- http://standart-lab.ru/images/unjailbreak-roblox-hack-download.pdfIn PDF document text
- https://corbo.ru/images/how-to-get-robux-on-roblox-free-2021.pdfIn PDF document text
- http://ruksnaitis.com/images/comment-hacker-un-jouer-roblox.pdfIn PDF document text
- https://www.seeingindependence.org/images/ultimate-random-night-how-to-hack-roblox.pdfIn PDF document text
- http://aeroclub-kaernten.at/images/how-to-hack-rpg-world-roblox.pdfIn PDF document text
- http://www.gongoff.com/images/redeem-code-roblox-free-robux-2021.pdfIn PDF document text
- http://harmonygardens.ca/images/how-to-use-cheat-engine-roblox.pdfIn PDF document text
- https://gomsa.nl/images/how-to-hack-roblox-wild-savannah-inf-health-hack.pdfIn PDF document text
- http://alexanderautos.co/images/roblox-mad-paintball-hack.pdfIn PDF document text
- http://domaizdereva24.ru/images/fre-chain-shirts-roblox.pdfIn PDF document text
- http://cepobajodeva.com/images/how-to-get-free-roubux-for-roblox.pdfIn PDF document text
- http://greenemiller.com/images/free-gift-cards-roblox-2021.pdfIn PDF document text
- http://swibome.nl/images/how-to-get-free-skins-in-counter-blox-roblox-offensive.pdfIn PDF document text
- http://www.mikramarine.gr/images/can-you-get-free-robux-from-creating-a-game.pdfIn PDF document text
- http://ghegamethu.vn/images/hacking-jakes-account-in-roblox.pdfIn PDF document text
- http://gamixpaliwa.pl/images/hack-royale-high-roblox.pdfIn PDF document text
- http://www.lovecraftiana.com.ar/images/cinnamon-hair-roblox-free.pdfIn PDF document text
- https://esl.ipb.ac.id/images/free-robux-costing-clothes.pdfIn PDF document text
- https://www.manmed.info:443/images/hack-to-hack-roblox.pdfIn PDF document text
- http://armportal.co.uk/images/roblox-hacker-kolorowanki-do-druku.pdfIn PDF document text
- https://www.europap.cz/images/haw-to-get-free-items-in-roblox-taglog-2021-march.pdfIn PDF document text
- http://mittlenberg.ch/images/cute-roblox-outfits-for-free.pdfIn PDF document text
- http://technologicalsc.com/images/roblox-heaven-free-robux.pdfIn PDF document text
+18 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000083f3.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x83F3	26492 bytes
SHA-256: `242314c0363fedf1c62ee9d86fc72b68aef527360efcd0d14b35155402399fa6`
`font_01_sfnt_off0000c032.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC032	18216 bytes
SHA-256: `55df7ca1cc09ec58896c575250a69a8787746a7cd11fe217243a2146d9edf0e5`

Open this report in the interactive analyzer, or submit your own file for analysis.