Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9daa53b2b0519bf…

MALICIOUS

PDF

52.2 KB Created: 2021-04-06 23:54:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 082835ba1dc8645b261d51def980aa88 SHA-1: 97673a881cc827a787910e12c80bd09d3ac828e5 SHA-256: b9daa53b2b0519bf23e7008123319759dafda229a56bb6c35127d75561abd349
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8896

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://vokna.by/images/how-to-get-free-stuff-on-roblox-2021-on-phone.pdfIn PDF document text
    • http://nosocomium.rv.ua/images/cheat-roblox-lumber-tycoon-2-fly.pdfIn PDF document text
    • http://www.occquimica.com.br/images/how-to-get-free-stuff-in-roblox-july-2021.pdfIn PDF document text
    • http://dos.most.gov.la/images/pastebin-free-robux-code.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/roblox-portal-heroes-cheats.pdfIn PDF document text
    • http://ekaterinakorneva.com/images/ultimate-driving-delancy-gorge-roblox-money-hack.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/roblox-how-to-change-your-username-for-free-2021.pdfIn PDF document text
    • https://www.brainpads.com/images/roblox-speed-hack-booga-booga.pdfIn PDF document text
    • https://www.lavigny.ch/images/roblox-free-robux-works-not-clickbait.pdfIn PDF document text
    • https://pemadamapi.net/images/todos-los-juegos-de-roblox-hack.pdfIn PDF document text
    • http://lewishome.net/images/how-to-hack-roblox-money-mac.pdfIn PDF document text
    • http://danielkleiboemer.de/images/free-roblox-on-computo.pdfIn PDF document text
    • http://batutynas.lt/images/roblox-hide-and-seek-free-online-game-for-kids.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/free-roblox-card-codes-not-used.pdfIn PDF document text
    • http://seytarehco.com/images/download-hack-roblox-jailbreak-money.pdfIn PDF document text
    • http://nikabio.com/images/roblox-cheat-god-mode.pdfIn PDF document text
    • https://www.europap.cz/images/i-am-hacking-roblox-jump.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/cheat-engine-65-download-roblox.pdfIn PDF document text
    • http://baah.ca/images/roblox-hacker-beta-download.pdfIn PDF document text
    • https://www.cj-aircons.co.za/images/free-robux-without-download-pc.pdfIn PDF document text
    • http://vipservice-bg.com/images/good-free-items-on-roblox.pdfIn PDF document text
    • http://damvallei.be/images/hacking-roblox-reddit.pdfIn PDF document text
    • http://domaizdereva24.ru/images/how-to-get-robux-for-free-on-bowser-instantly.pdfIn PDF document text
    • https://www.hotschool.com.au/images/how-to-get-free-vip-in-roblox-fashion-famous.pdfIn PDF document text
    • http://elearnfactory.com/images/checkmein-roblox-free.pdfIn PDF document text
    • http://ecoleduchat-grenoble.fr/images/barren-hacks-roblox.pdfIn PDF document text
    • https://lobergetart.se/images/roblox-murder-mystery-2-hack-2021.pdfIn PDF document text
    • http://www.tank-pads.com/images/como-hackear-robux-en-roblox-facil-y-rapido.pdfIn PDF document text
    • http://k2visual.com.br/images/roblox-mod-apk-hack.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/free-3d-online-games-like-roblox.pdfIn PDF document text
    • http://vedrachemicals.ro/images/download-roblox-hack-pc.pdfIn PDF document text
    • http://jenne-technik.de/images/roblox-jailbroken-hack.pdfIn PDF document text
    • https://zapoj-kharkov.com.ua/images/roblox-free-exploits-download.pdfIn PDF document text
    • https://gabrieliassociati.com/images/free-robux-code-generator-online.pdfIn PDF document text
    • https://helsoft.se/images/free-robux-obby-no-password-2021.pdfIn PDF document text
    • http://www.anies.eu/images/yarxvin-roblox-hacks.pdfIn PDF document text
    • https://www.porthos.it/images/how-to-hack-roblox-accounts-with-edit-this-cookie-2021.pdfIn PDF document text
    • http://www.isril.it/images/free-items-in-the-roblox-catalog.pdfIn PDF document text
    • http://www.actae.gr/images/roblox-bucks-hack.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/hack-de-una-espada-ra-roblox.pdfIn PDF document text
    • https://bancroftandsons.com/images/how-to-get-free-robux-on-a-ipad-2021.pdfIn PDF document text
    • http://xn----7sbq6amdnuk.xn--p1ai/images/roblox-when-will-bloxburg-be-free.pdfIn PDF document text
    • http://enosiderma.gr/images/roblox-black-pants-red-shoes-free.pdfIn PDF document text
    • http://www.torvet11.dk/images/hacker-roblox-shirt.pdfIn PDF document text
    • https://gabrieliassociati.com/images/how-to-get-free-robux-legit-serious-hack.pdfIn PDF document text
    • http://ns1.radiofacil.net/images/free-running-in-parkour-roblox.pdfIn PDF document text
    • http://keepcasscountybeautiful.com/images/rbxoffers-free-robux.pdfIn PDF document text
    • https://bdhcpa.com/images/free-robux-giveiaway.pdfIn PDF document text
    • http://julo-it.net/images/hack-para-atravesar-paredes-en-roblox-2021.pdfIn PDF document text
    +16 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006dc5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6DC5 26164 bytes
SHA-256: 4c8324247a7aba5805f21e9390fc15e8874b1a5d8d24a507c5f59d7945ebfe90
font_01_sfnt_off0000a833.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA833 18196 bytes
SHA-256: f5e4ce74d0337a4608452bd20d3ddadb3f887180e004faa22fecffe6d9f58d25