Malicious PDF — malware analysis report

Static analysis result for SHA-256 cecaa36c2b62ed42…

MALICIOUS

PDF

57.8 KB Created: 2021-04-06 01:03:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 22ffa7c9bf4e0e2b5adb393981e45d34 SHA-1: 377beb5b22ed5f33a136918de5f7408ac4a84a5b SHA-256: cecaa36c2b62ed42099caa742303a59ab30bb7a809121885853eec636dc317f1
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document uses urgency and brand impersonation lures, specifically mentioning Microsoft and offering free Robux, to trick users into clicking malicious links. The primary link, http://gaminggenerator.org/app/431946152/is-it-possible-to-get-robux-for-free, is associated with credential phishing or malware distribution. While no scripts were explicitly extracted, the PDF format and embedded URLs suggest potential for JavaScript execution or direct user interaction with malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 5

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/is-it-possible-to-get-robux-for-free.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/is-it-possible-to-get-robux-for-free PDF link annotation
    • http://ns1.radiofacil.net/images/www-hacker-de-roblox.pdfIn PDF document text
    • http://hindicenter.com/images/how-to-get-free-roblox-codes-2021.pdfIn PDF document text
    • https://bancroftandsons.com/images/what-is-the-robux-hex-value-in-cheat-engine.pdfIn PDF document text
    • https://lobergetart.se/images/robux-hack-ultimate-gamer-365.pdfIn PDF document text
    • https://www.academiaanticorrupcion.org/images/how-add-robux-to-used-roblox-card-cheat.pdfIn PDF document text
    • http://truebibleteaching.com/images/roblox-free-daily-robux.pdfIn PDF document text
    • http://www.flotom.at/images/roblox-free-printables-party.pdfIn PDF document text
    • http://ff-obertraun.at/images/free-robux-earner.pdfIn PDF document text
    • http://xn-----clcdhzcbmgnochhb1boe1a6b.xn--p1ai/images/free-robux-3-steps.pdfIn PDF document text
    • https://lesegais.ru/images/how-do-you-hack-pn-roblox.pdfIn PDF document text
    • http://kfz-service-etp.de/images/free-robux-zeth.pdfIn PDF document text
    • https://www.hbproducts.dk/images/now-to-get-free-robux.pdfIn PDF document text
    • http://depilhome-fr.fr/images/free-perm-admin-roblox.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/roblox-it-free.pdfIn PDF document text
    • https://rincondelentrenador.com/images/free-code-2021-roblox.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/roblox-jojos-bizarre-adventure-script-hack.pdfIn PDF document text
    • http://arhi-z.ru/images/arsenal-hacks-roblox-2021.pdfIn PDF document text
    • https://seedungo.com/images/free-shirt-roblox-2021.pdfIn PDF document text
    • http://www.das-kinderzimmer.net/images/how-to-hack-roblox-with-charles.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/free-robux-without-human-verification-website.pdfIn PDF document text
    • http://www.exikom.com.ua/images/guest-pants-roblox-free.pdfIn PDF document text
    • http://abqwinair.com/images/roblox-critical-strike-hack-script.pdfIn PDF document text
    • http://bernd-voehringer.de/images/free-robux-bc.pdfIn PDF document text
    • http://hospitalsalamanca.cl/images/roblox-dll-hacks.pdfIn PDF document text
    • http://www.jureclomas.com.ar/images/free-roblox-redeem-codes-that-haven-39.pdfIn PDF document text
    • http://www.pbconsulting.it/images/roblox-skywars-hack-fly.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/free-online-multiplayer-games-like-roblox.pdfIn PDF document text
    • https://www.cnte.org.br/images/i-love-cats-shirt-roblox-free-denis.pdfIn PDF document text
    • http://consultinggirona.es/images/descargar-hack-roblox-jailbreak-2021.pdfIn PDF document text
    • https://www.inova-cuisine.fr/images/free-robux-no-offers-or-survey-2021.pdfIn PDF document text
    • https://hassel-event.de/images/how-to-hack-all-the-games-in-roblox.pdfIn PDF document text
    • https://bancroftandsons.com/images/free-robux-codes-without-builders-club.pdfIn PDF document text
    • https://corbo.ru/images/roblox-free-ss-excutor.pdfIn PDF document text
    • http://armportal.co.uk/images/are-there-any-free-items-in-the-store-for-roblox.pdfIn PDF document text
    • http://www.beantownlimo.com/images/roblox-dbor-q-button-hack.pdfIn PDF document text
    • http://famoirs.co.uk/images/free-robux-2021-october.pdfIn PDF document text
    • http://finettifrs.it/images/free-money-script-roblox-pastebin.pdfIn PDF document text
    • http://jbm-constructions.com/images/20210-robux-for-free.pdfIn PDF document text
    • https://tokunfome.com.br/images/reddit-roblox-money-hacks.pdfIn PDF document text
    • https://domoticaaplicada.com/images/how-can-you-get-hacked-on-roblox.pdfIn PDF document text
    • http://legs11.co.za/images/how-to-get-any-face-free-on-mac-roblox.pdfIn PDF document text
    • https://www.osoc.com/images/free-robux-accounts-roblox.pdfIn PDF document text
    • http://musical-arts.de/images/how-to-get-free-robux-hack-website.pdfIn PDF document text
    • http://www.backlineservice.nl/images/free-robux-on-united-kingdom.pdfIn PDF document text
    • http://www.evaplast.by/images/how-to-get-free-robux-legit-pc.pdfIn PDF document text
    • http://global-tech-security.be/images/advertise-for-free-robux.pdfIn PDF document text
    • http://www.visiblefilm.com/images/hacking-roblox-pastebin.pdfIn PDF document text
    • http://julo-it.net/images/how-to-create-a-shirt-for-free-on-roblox.pdfIn PDF document text
    • http://genialica.com/images/zephplayz-how-to-get-free-robux.pdfIn PDF document text
    +14 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000083a4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x83A4 26092 bytes
SHA-256: 1e2a9e60ede718b1bd56b22b5b71da1287d73b48ab26e8b30d98e5f4149c6ed5
font_01_sfnt_off0000bfb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFB7 17888 bytes
SHA-256: fb6175e5f315d42c6e174fdb0b20dfd2a668ec67de12c4a180861f299f87b126

Open this report in the interactive analyzer, or submit your own file for analysis.