Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0edebb89831eb8b…

MALICIOUS

PDF

234.4 KB Created: 2021-04-04 17:03:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: d698cc915231a0b1a1d4116e9675168b SHA-1: c8df151a099ea5a300b6e1272f7c57e82141d3a2 SHA-256: d0edebb89831eb8b3e168da963ab5c504e1f8a655e60efa3b9c8fe696d33da95
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a lure related to 'Roblox Guess That Character Free Robux' and an embedded URI pointing to a suspicious domain. ClamAV detection confirms this is a phishing document. While no scripts were directly extracted, the presence of an external URI suggests an attempt to download a secondary payload or redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier clean score 0.0491

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-guess-that-character-free-robux PDF link annotation
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00035651.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35651 21476 bytes
SHA-256: e0652382d780abe4d39d497260cc6fa5945f9181fa891a6091bc0766e8b519fe
font_01_sfnt_off0003857c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3857C 18152 bytes
SHA-256: 97eb37bf9a2607bc7e3742d4b581cea2922cb5d541cbbaf83b8edd499a709ac0

Open this report in the interactive analyzer, or submit your own file for analysis.