PDF malware analysis — malicious · c6f238a88c3e6fe3

MALICIOUS

PDF

54.6 KB Created: 2021-04-06 13:58:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-12

MD5: b1d1262b0cafb61ca2cc49450e0a5ecf SHA-1: 533ff36ad9dc3520821b663534f0660ab89d874d SHA-256: c6f238a88c3e6fe30cd8a33f404ddee7845d1dd54b8bb1b3786f43782683aa6e

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs, with a prominent heuristic indicating a lure for a 'free generator / game hack'. The document body, though partially corrupted, contains references to game hacks and a primary URL that reinforces this theme. The presence of numerous related URLs suggests a campaign distributing links to potentially malicious content or phishing pages. No scripts were extracted, but the overall pattern points to social engineering via a fake game hack lure.

Machine Learning

Nyx PDF Classifier malicious score 0.6397

Heuristics 4

PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://cleanteclogistics.com/images/pastebin-raw-free-robux.pdfIn PDF document text
- https://septik-montag.ru/images/free-robux-hack-pastebin.pdfIn PDF document text
- http://ekaterinakorneva.com/images/get-free-robux-on-roblox-app.pdfIn PDF document text
- http://www.herbasacra.gr/images/free-robux-pagedemo-co.pdfIn PDF document text
- http://agroturismoarkaia.com/images/robux-pin-codes-free.pdfIn PDF document text
- http://kulturlandschaften.eu/images/roblox-hack-prank.pdfIn PDF document text
- https://inspiration-modellbau.de/images/game-guardian-roblox-money-hack.pdfIn PDF document text
- https://www.bmta.co.uk/images/cheat-roblox-jailbreak-2021.pdfIn PDF document text
- http://pourvosvacances.com/images/roblox-admin-hack-pastebin.pdfIn PDF document text
- https://www.abrapppe.org.br/images/roblox-hack-account-free.pdfIn PDF document text
- http://demenagementlandry.com/images/roblox-robux-hack-for-mac.pdfIn PDF document text
- http://www.art-concept.gr/images/roblox-rux-hack.pdfIn PDF document text
- http://kcr-rochlitz.de/images/roblox-hack-name-and-password.pdfIn PDF document text
- http://brokermortgages.com/images/youtube-link-to-roblox-jailbreak-hack-music.pdfIn PDF document text
- https://www.vacationrentalsincroatia.com/images/try-roblox-for-free.pdfIn PDF document text
- http://www.lycee-langevin-wallon.com/images/free-roblox-robux-generator-2021.pdfIn PDF document text
- http://cosver.eu/images/roblox-what-to-do-if-you-get-hacked.pdfIn PDF document text
- http://moralcenter.or.th/images/roblox-private-server-free.pdfIn PDF document text
- https://consorziocsa-asicaivano.it/images/pastebin-free-robux-code.pdfIn PDF document text
- http://panaceafamilymedicine.com/images/how-to-hack-roblox-to-stop-getting-rapid-killed.pdfIn PDF document text
- https://www.dressel-immobilien-mv.de/images/roblox-any-way-to-make-robux-for-free.pdfIn PDF document text
- http://www.brtes.com/images/robux-and-tix-hack-no-survey-no-download.pdfIn PDF document text
- http://msfs-eastafrica.com/images/roblox-pet-simulator-hack-script-pastebin.pdfIn PDF document text
- http://musical-arts.de/images/roblox-counterstrike-hack.pdfIn PDF document text
- http://escolaarboc.cat/images/roblox-exploit-download-for-free.pdfIn PDF document text
- https://www.utalii.ac.ke/images/how-to-hack-roblox-2021.pdfIn PDF document text
- http://geometraperiotto.it/images/roblox-free-with-pastebin.pdfIn PDF document text
- https://www.lavigny.ch/images/free-roblox-accounts-with-obc-2021.pdfIn PDF document text
- http://www.visiblefilm.com/images/free-robux-no-downloads-needed.pdfIn PDF document text
- http://www.gravel.ru/images/free-roblox-skin-codes.pdfIn PDF document text
- http://junktiquecollector.com/images/free-robux-generator-simulator.pdfIn PDF document text
- http://glaubensfragen.org/images/get-free-robux-offers.pdfIn PDF document text
- http://glaubensfragen.org/images/jailbreak-roblox-hack-2021.pdfIn PDF document text
- http://safwafurniture.com/images/como-hackear-roblox-en-android-sin-root.pdfIn PDF document text
- https://www.porthos.it/images/free-idle-animation-roblox.pdfIn PDF document text
- http://svp-steinmaur.ch/images/free-robux-no-check-if-huan.pdfIn PDF document text
- http://possumholler.us/images/jailbreak-roblox-money-hack.pdfIn PDF document text
- http://www.evaplast.by/images/hacked-robux-wok.pdfIn PDF document text
- https://www.lauresa.de/images/free-robux-hack-on-computer.pdfIn PDF document text
- http://bressanassessoria.com.br/images/cheat-scp-roblox.pdfIn PDF document text
- https://www.les-sp.org/images/roblox-how-to-hack-robots-with-cheat-engine-64.pdfIn PDF document text
- http://shootawayproduction.com/images/free-roblox-army-template.pdfIn PDF document text
- http://fmbompastor.com.br/images/roblox-codes-to-get-free-clothes.pdfIn PDF document text
- http://www.rezbb.sk/images/roblox-redeem-code-free.pdfIn PDF document text
- http://codicicolori.com/images/install-roblox-free-latest-version.pdfIn PDF document text
- http://swibome.nl/images/hack-robux-wok.pdfIn PDF document text
- https://bdsm-centrum.com/images/how-to-hack-undertale-au-rpg-roblox.pdfIn PDF document text
- https://www.osoc.com/images/how-to-get-everything-free-on-roblox-2021-april.pdfIn PDF document text
- https://www.cnte.org.br/images/comoser-hacker-en-roblox.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006e9f.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6E9F	24816 bytes
SHA-256: `64cd69a23ff21a5649b1412cc28e3e38443601f4dad4d31e5c3df881939a3b95`
`font_01_sfnt_off0000a6fa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA6FA	2832 bytes
SHA-256: `77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2`
`font_02_sfnt_off0000b0ab.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB0AB	18584 bytes
SHA-256: `64f6a6793c413ae0e766e7d3f6096198e17fcf2054527ad181a8d7c3d64e90ee`

Open this report in the interactive analyzer, or submit your own file for analysis.