Malicious PDF — malware analysis report

Static analysis result for SHA-256 b765ab0edaa2fa80…

MALICIOUS

PDF

61.2 KB Created: 2021-04-05 20:43:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 19abe2f68bbe351f8a48d933ceb96eb9 SHA-1: dad4ccede973d8b2a8e9443b32b398354a6e7871 SHA-256: b765ab0edaa2fa80c68d1843060dea77a90b2ff539147189d6f8e4b7bd803bf8
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous links to external websites, identified by the PDF_GAME_HACK_SEO_LINK_FARM heuristic, that promise free Robux and game hacks. The document body and extracted URLs confirm this lure, directing users to sites like 'gaminggenerator.org'. This pattern suggests the file is designed to lead users to scam websites or potentially download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-202120212021202120212021202120212021202120212021-robux PDF link annotation
    • https://laconce.com/images/how-to-hack-peoples-roblox-account.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/how-to-noclip-in-roblox-without-cheat-engine.pdfIn PDF document text
    • http://www.learningbydoinglingue.com/images/hacks-para-roblox-jailbreak-2021.pdfIn PDF document text
    • https://www.bmta.co.uk/images/how-to-get-free-hair-on-roblox-on-phone.pdfIn PDF document text
    • http://eleveurs-autrement.fr/images/roblox-elemental-battlegrounds-hack-gems.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/how-to-get-free-robux-2021-legit-working-100.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/hack-roblox-accounts-download-file.pdfIn PDF document text
    • https://schulzpressetext.de/images/roblox-jailbreak-money-hack-2021-trke.pdfIn PDF document text
    • https://www.yewtreealpacas.co.uk/images/free-robux-from-watching-ads.pdfIn PDF document text
    • http://dottgagliardi.com/images/roblox-best-exploit-cheat-ever.pdfIn PDF document text
    • http://www.liceoantoniotoledo.com/images/roblox-speed-race-hacks.pdfIn PDF document text
    • https://www.iadh.bi/images/free-items-on-roblox-mobile.pdfIn PDF document text
    • http://musical-arts.de/images/cheat-roblox-soros-resataurant.pdfIn PDF document text
    • http://condit-pack.com/images/blockzone-site-free-robux.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/how-to-hack-and-know-what-people-are-inmm2-roblox.pdfIn PDF document text
    • http://force-seniorklub.dk/images/will-they-cheat-roblox-thumbnail.pdfIn PDF document text
    • http://eau-petit-pont.com/images/roblox-hack-no-human-verification-or-survey-2021.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/free-roblox-tshirt-shark-blox.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/free-items-in-roblox-2021.pdfIn PDF document text
    • http://julo-it.net/images/windows-roblox-hack-client-2021.pdfIn PDF document text
    • http://dorfgaragethalwil.ch/images/youtube-how-to-hack-roblox-to-get-robux.pdfIn PDF document text
    • https://sectorpravdy.com/images/how-to-earn-free-robux-in-roblox.pdfIn PDF document text
    • http://lichtdrukkerijwijchen.nl/images/robux-hack-no-survey-no-human-verification-2021.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/diamond-roblox-hack.pdfIn PDF document text
    • http://pesok-rk.ru/images/cheat-2021-robux.pdfIn PDF document text
    • http://brokermortgages.com/images/roblox-free-card-codes-december-2021.pdfIn PDF document text
    • http://mechanism.gr/images/roblox-minecraft-game-free.pdfIn PDF document text
    • https://accord.kiev.ua/images/get-free-robux-on-a-ipad.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/roblox-cheats-for-robux-android.pdfIn PDF document text
    • http://www.inservis.cl/images/how-to-earn-robux-for-free-in-roblox.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/free-roblox-card-codes-august-2021.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/free-robux-hack-2021.pdfIn PDF document text
    • http://lanoblaie.fr/images/roblox-sunset-city-money-hack.pdfIn PDF document text
    • http://www.homesweethome.pl/images/check-background-net-roblox-hack.pdfIn PDF document text
    • http://finettifrs.it/images/get-free-items-on-roblox.pdfIn PDF document text
    • https://sdg-trade.com/images/roblox-super-power-training-simulator-cheats.pdfIn PDF document text
    • https://www.saisystem.it/images/wfb-roblox-hacker.pdfIn PDF document text
    • http://eleveurs-autrement.fr/images/free-roblox-accounts-with-no-robux.pdfIn PDF document text
    • http://www.boic.nl/images/rblx-gg-free-robux-today.pdfIn PDF document text
    • http://brokermortgages.com/images/free-robux-without-getting-banned.pdfIn PDF document text
    • https://sectorpravdy.com/images/rbxnow-gg-get-free-robux-on-roblox-playing-games.pdfIn PDF document text
    • http://kim-kinder-im-mittelpunkt.de/images/fairy-world-roblox-hack-pastebin.pdfIn PDF document text
    • https://www.audev.com/images/ccv5-roblox-dbfp-hack-tuto-2021.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/roblox-free-without-installing.pdfIn PDF document text
    • https://lesegais.ru/images/galaxy-cheats-roblox.pdfIn PDF document text
    • http://www.mediaxin.net/images/free-song-id-roblox.pdfIn PDF document text
    • http://engelum.com/images/roblox-dragon-ball-online-stats-hack.pdfIn PDF document text
    • http://loszavera.com/images/shinobi-life-level-hack-roblox.pdfIn PDF document text
    • http://energotestcontrol.ru/images/simply-glich-to-get-free-robux-youtube.pdfIn PDF document text
    +12 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000830d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x830D 28132 bytes
SHA-256: 82527c267e3f963ccc13fc75b1d418959f8ade6a8cdc0f0c7657e7339aa6dc91
font_01_sfnt_off0000c3fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC3FA 2848 bytes
SHA-256: 4737c2778a085e0cb49e73f3b054b1a71e3f40720d213b4bfda97f95a31bfbf1
font_02_sfnt_off0000cdbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDBB 17648 bytes
SHA-256: b67460870721628ce45c71fa2aedca258ba7137944c5c794d7af0eccbb06666f