PDF malware analysis — malicious · c3dee3d03cadd002

MALICIOUS

PDF

59.2 KB Created: 2021-04-05 22:08:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-02

MD5: 303b31b051dd0a9e172ce49e318da362 SHA-1: 3fbbbd9b8cc248494bccab8c41660d06d0354a3d SHA-256: c3dee3d03cadd002608c0355838c69c36b2b3673a8de2ba03dafc6891bb382c9

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link T1553.005 Security Software Installation

The document uses a lure related to "hacking into my brothers Roblox account" and instructs the user to disable security software, a common tactic for social engineering. It also prompts the user to install a browser extension or update, which is a known method for malware delivery or credential harvesting. While no scripts were directly extracted, the PDF structure and embedded URLs suggest it's designed to lead the user to malicious content or downloads.

Machine Learning

Nyx PDF Classifier malicious score 0.6397

Heuristics 5

Security software disable instruction high SE_SECURITY_BYPASS

Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/hacking-into-my-brothers-roblox-account PDF link annotation
- http://fiur-malermeister.de/images/roblox-lawn-mower-simulator-hack.pdfIn PDF document text
- https://www.europap.cz/images/free-robux-hack-generator-2021-no-human-verification.pdfIn PDF document text
- http://5346000.com/images/roblox-greenwood-town-how-to-get-free-deathbringer.pdfIn PDF document text
- http://petarda.hu/images/cheat-apocalypse-rising-roblox-25-fvrier-2021.pdfIn PDF document text
- http://kaleasm.org/images/code-robux-free-2021.pdfIn PDF document text
- http://erntefest2016.de/images/island-royale-roblox-hack.pdfIn PDF document text
- http://butkimloai.com/images/how-to-get-free-robux-using-inspect-element-2021.pdfIn PDF document text
- https://lobergetart.se/images/comment-hack-sur-roblox.pdfIn PDF document text
- http://jointworkstudio.com/images/hack-para-roblox-en-espaol.pdfIn PDF document text
- http://alpen-seeblick.at/images/roblox-free-to-play-games.pdfIn PDF document text
- http://seniornetwanganui.org.nz/images/free-clothes-of-roblox.pdfIn PDF document text
- http://www.actae.gr/images/roblox-hack-apk-2021.pdfIn PDF document text
- https://www.stoehr-sauer.de/images/how-to-get-free-robux-without-verification-on-ipad.pdfIn PDF document text
- http://imp.lg.ua/images/free-robux-card-no-humaon-verification-2021.pdfIn PDF document text
- http://fa-deco.com/images/grief-hack-roblox.pdfIn PDF document text
- http://prohsa.com/images/roblox-stamper-tool-hack.pdfIn PDF document text
- https://www.ergolight.at/images/roblox-administrator-badge-hack-2021.pdfIn PDF document text
- http://www.lionel-seppoloni.fr/images/how-to-get-free-robux-east-on-anithing.pdfIn PDF document text
- https://gestionpatrimonial.net/images/free-makeup-roblox-faces.pdfIn PDF document text
- http://www.peterdejonge.nl/images/dbz-final-stand-roblox-cheats.pdfIn PDF document text
- http://sandra-masemann.de/images/free-roblox-clothes-event.pdfIn PDF document text
- http://chartsmart.com.au/images/free-robux-games-no-scam.pdfIn PDF document text
- https://www.albisser.ch/images/how-to-hack-models-into-roblox-tshirts.pdfIn PDF document text
- http://ascom4.com/images/como-hackear-uma-conta-do-roblox.pdfIn PDF document text
- http://cmme.it/images/robux-hack-line-of-code.pdfIn PDF document text
- https://www.tsdb.com.au/images/como-hackear-roblox-en-android-sin-root.pdfIn PDF document text
- https://pa-waingapu.go.id/images/how-to-hack-a-person-on-roblox-2021.pdfIn PDF document text
- http://feuerwehr-rheinau.de/images/roblox-knife-ability-test-hack.pdfIn PDF document text
- https://www.lomrad.go.th/images/roblox-jump-hack.pdfIn PDF document text
- https://www.hbproducts.dk/images/minecraft-roblox-games-free.pdfIn PDF document text
- http://ff-obertraun.at/images/system48-roblox-hack.pdfIn PDF document text
- http://www.torvet11.dk/images/how-to-hack-work-at-a-pizza-place-roblox.pdfIn PDF document text
- http://hydroconseil.net/images/lemon-aid-roblox-hack.pdfIn PDF document text
- http://www.imperialaccountingfl.com/images/how-to-earn-free-robux-without-downloading-apps.pdfIn PDF document text
- http://altc.de/images/roblox-money-hack-2021.pdfIn PDF document text
- http://armatrutz.de/images/roblox-how-to-hack-accounts-with-cookie-editor.pdfIn PDF document text
- http://schlossschaenke-andernach.de/images/roblox-how-to-get-free-packages.pdfIn PDF document text
- http://www.actae.gr/images/how-to-get-free-audio-uin-roblox-2021.pdfIn PDF document text
- http://www.zdravazena.sk/images/hire-a-free-roblox-scripter.pdfIn PDF document text
- https://www.imagevideo.info/images/roblox-hack-root.pdfIn PDF document text
- http://www.eaapiaria.es/images/roblox-pet-simulator-hack-2021.pdfIn PDF document text
- http://businessfit.com/images/roblox-plane-free.pdfIn PDF document text
- http://acktivities.com/images/bloxburg-roblox-money-hack.pdfIn PDF document text
- http://www.pcclawyers.com.au/images/roblox-girl-hairs-free.pdfIn PDF document text
- https://technospektr.com.ua/images/cheat-roblox-fly.pdfIn PDF document text
- https://komakinosite.jp/images/roblox-code-free.pdfIn PDF document text
- http://a1scan3d.com/images/roblox-city-of-london-money-hack.pdfIn PDF document text
- http://domaizdereva24.ru/images/free-robux-hack-computer.pdfIn PDF document text
- https://pagadder.com/images/how-to-earn-free-millons-of-robux.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00007d92.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x7D92	25216 bytes
SHA-256: `e33f9d77611e615bde9e041d5d4bc144c16916c50839784a84889e2ff7b0c3bb`
`font_01_sfnt_off0000b783.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB783	2896 bytes
SHA-256: `90d77d065f93150ee652ed3ce79924b5ebfcae47abf79a24366adbef9fa21c4a`
`font_02_sfnt_off0000c182.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC182	19100 bytes
SHA-256: `fec9a8730dbdb551b2f3d3ddbd0134767728f06919812a908d3e6d0341621df1`

Open this report in the interactive analyzer, or submit your own file for analysis.