PDF malware analysis — malicious · c0e3e45937864ab1

MALICIOUS

PDF

57.5 KB Created: 2021-04-05 20:21:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 63d6ca84a289ed4eaca1a3a473e72e20 SHA-1: 93995ee1cd30505056f18e4baae97394665e0221 SHA-256: c0e3e45937864ab1f262ec7f31351d8a9b2fb6bcc572573c04f85e0a6ae74584

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

This PDF document was flagged as malicious by an ML classifier. It uses brand-impersonation credential phishing. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.7795

Heuristics 4

Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/hack-roblox-robux-real-working.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/hack-roblox-robux-real-working PDF link annotation
- https://letturatarghe.it/images/roblox-op-weapons-in-your-inventory-hack.pdfIn PDF document text
- http://bb-im2.com/images/free-roblox-cad-code.pdfIn PDF document text
- http://mklista.ru/images/overhol-roblox-free-shop-2021.pdfIn PDF document text
- https://www.cosmosdawn.net/images/free-obc-roblox-pastebin.pdfIn PDF document text
- http://www.ntc.edu.za/images/free-fall-roblox.pdfIn PDF document text
- https://cdu-lengerich.de/images/free-robux-no-human-verification-or-survey-no-email.pdfIn PDF document text
- https://www.porthos.it/images/how-ot-get-free-clothrs-in-the-catalog-on-roblox.pdfIn PDF document text
- http://www.lionel-seppoloni.fr/images/roblox-free-bc-inspect-element.pdfIn PDF document text
- http://haertetechnik-steinbach.de/images/how-to-get-free-robux-and-obc-by-xdaniel.pdfIn PDF document text
- http://ofthalmiatrosthess.gr/images/how-to-hack-roblox-with-lucky-patcher-2021.pdfIn PDF document text
- http://webstan.be/images/roblox-shinobi-life-hack.pdfIn PDF document text
- http://aeroclub-kaernten.at/images/easy-hack-to-get-halos-in-royale-high-roblox.pdfIn PDF document text
- https://www.hbproducts.dk/images/roblox-work-at-a-pizza-place-manager-hack.pdfIn PDF document text
- http://alexanderautos.co/images/roblox-free-robux-no-verification.pdfIn PDF document text
- https://verdensbarn.no/images/bbg-free-robux.pdfIn PDF document text
- https://www.cnte.org.br/images/free-roblox-accounts-2021-with-robux-december.pdfIn PDF document text
- https://www.udivadlahotel.cz/images/how-to-download-roblox-cheat-engine.pdfIn PDF document text
- http://armportal.co.uk/images/roblox-shooting-range-free.pdfIn PDF document text
- http://internetdeputy.com/images/roblox-lumbertycoon-2-grief-hack.pdfIn PDF document text
- http://www.gongoff.com/images/roblox-cheat-2021-with-temp-files.pdfIn PDF document text
- https://www.vacationrentalsincroatia.com/images/free-roblox-account-generator-youtube.pdfIn PDF document text
- http://www.lascalamilanowallcovering.it/images/asshurt-roblox-multitool-free.pdfIn PDF document text
- https://bancroftandsons.com/images/i-think-someone-hacked-my-roblox-account.pdfIn PDF document text
- http://www.exikom.com.ua/images/free-robux-for-roblox-2021.pdfIn PDF document text
- http://www.mikramarine.gr/images/free-robux-game-on-roblox-2021.pdfIn PDF document text
- https://servotecnica.com/images/byfanatics-co-free-robux.pdfIn PDF document text
- http://www.evaplast.by/images/hack-place-roblox-2021.pdfIn PDF document text
- http://atelierweb.it/images/blocky-world-free-robux.pdfIn PDF document text
- https://www.najeebqasmi.com/images/wild-revolvers-roblox-hack.pdfIn PDF document text
- http://www.htc.edu.au/images/roblox-dinosaur-simulator-cheat-engine-dna.pdfIn PDF document text
- http://pourvosvacances.com/images/como-tener-los-hacks-de-xonnkek-roblox-jailbreak.pdfIn PDF document text
- http://linde-erbach.de/images/roblox-free-expoit-that-run-loadstring.pdfIn PDF document text
- http://bullyinformate.org/images/roblox-hack-apk-robux.pdfIn PDF document text
- https://corbo.ru/images/how-to-hack-roblox-for-admin-commands.pdfIn PDF document text
- http://kfz-service-etp.de/images/como-dibujar-en-free-draw-roblox.pdfIn PDF document text
- http://www.agri-tech.com.au/images/roblox-secret-free-items.pdfIn PDF document text
- http://www.lionel-seppoloni.fr/images/how-to-free-yourself-in-notorious-roblox.pdfIn PDF document text
- https://www.wildpark-johannismuehle.de/images/roblox-jailbreak-2021-btools-hack.pdfIn PDF document text
- http://linde-erbach.de/images/robux-hack-no-human-verification-2021.pdfIn PDF document text
- http://pa-tanjungselor.go.id/images/hacked-msg-for-roblox.pdfIn PDF document text
- https://www.wijhalenhetop.nl/images/get-free-promo-codes-for-roblox.pdfIn PDF document text
- http://ehma.com/images/roblox-rc7-cracked-free-downlaod.pdfIn PDF document text
- https://www.coriglianocalabro.it/images/hack-script-for-one-piece-legendary-roblox-copy-and-paste.pdfIn PDF document text
- https://ambarevleri.com/images/how-to-get-free-robux-no-pastebin.pdfIn PDF document text
- https://gomsa.nl/images/roblox-always-day-hack.pdfIn PDF document text
- http://cepobajodeva.com/images/best-games-on-roblox-that-are-free.pdfIn PDF document text
- http://www.exikom.com.ua/images/exploit-free-roblox.pdfIn PDF document text
- https://www.najeebqasmi.com/images/royale-high-roblox-hacks.pdfIn PDF document text
- http://ktn.com.br/images/free-builders-club-roblox-script.pdfIn PDF document text
+15 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000082dc.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x82DC	25008 bytes
SHA-256: `4b60216b4d48a6969356239b8d0b6bcb89735761c9950c56a6b9fefb0823f7f7`
`font_01_sfnt_off0000bcb9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBCB9	18460 bytes
SHA-256: `708cbaa292d6dfe465fae8cf26affa1f6752e0032cabd5bff766f6494d12fef6`

Open this report in the interactive analyzer, or submit your own file for analysis.