Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2405e13075b504c…

MALICIOUS

PDF

60.1 KB Created: 2021-04-05 18:23:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-14
MD5: aa76ade1a9fa39ca240525245994e703 SHA-1: 98277589323f070299869a726eec1ffd602c837e SHA-256: d2405e13075b504c767efbc888d86bd906f65d3a9e1c5f55bba6645c56337f34
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous links to websites that appear to be part of a link farm or scam operation, specifically targeting users interested in game hacks and free items for Roblox. The heuristic firings indicate a high likelihood of malicious intent, with the primary goal being to direct users to potentially harmful external sites. No scripts were extracted, but the embedded URLs and document body content strongly suggest a phishing or scam lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7417

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/who-did-the-hackers-hack-in-roblox PDF link annotation
    • http://www.vktzunami.cz/images/free-roblox-valkyrie-giveaway.pdfIn PDF document text
    • http://harmonygardens.ca/images/download-roblox-free-on-the-apple-store.pdfIn PDF document text
    • http://www.gongoff.com/images/how-to-set-up-pf-pros-roblox-cheats.pdfIn PDF document text
    • https://lita-lb.org/images/youtube-how-to-get-free-robux-hack.pdfIn PDF document text
    • http://agrao.in/images/roblox-snow-shoveling-simulator-free-santa-bag-ijf.pdfIn PDF document text
    • http://onlinemusicsolutions.com.au/images/free-roblox-accounts-whit-gamepasses.pdfIn PDF document text
    • http://almacargo.com/images/comment-hacker-le-cataloggue-de-roblox.pdfIn PDF document text
    • http://www.gadanie.lv/images/como-dibujar-en-free-draw-roblox.pdfIn PDF document text
    • http://www.hotelcimone.it/images/free-barbie-roblox-games.pdfIn PDF document text
    • http://ns1.radiofacil.net/images/free-robux-generator-download-2021.pdfIn PDF document text
    • http://brokermortgages.com/images/hack-robux-2021.pdfIn PDF document text
    • http://techmobil.pl/images/how-to-get-free-bc-on-roblox-2021.pdfIn PDF document text
    • http://www.drent.se/images/free-old-roblox-accunts.pdfIn PDF document text
    • http://fiur-malermeister.de/images/free-state-of-wrttemberg-roblox.pdfIn PDF document text
    • https://uofk.edu/images/roblox-play-online-free-no-download.pdfIn PDF document text
    • http://www.cuniv-naama.dz/images/roblox-avatar-for-hackers.pdfIn PDF document text
    • http://uptodate.az/images/free-robux-quiz-roblox.pdfIn PDF document text
    • http://www.mikramarine.gr/images/robux-roblox-secret-hacks.pdfIn PDF document text
    • https://wandersuechtig.de/images/free-dominus-roblox-2021.pdfIn PDF document text
    • http://www.cosver.nl/images/how-to-get-free-bc-on-roblox.pdfIn PDF document text
    • https://grovehilloutfitters.com/images/roblox-software-free-download.pdfIn PDF document text
    • https://www.audev.com/images/roblox-its-free-remix-id.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/roblox-redeem-card-codes-hack.pdfIn PDF document text
    • https://koeltotaal.com/images/roblox-lumber-tycoon-2-money-hack-deutsch.pdfIn PDF document text
    • http://iacovoulaw.com/images/free-robux-no-human-verification-no-lie.pdfIn PDF document text
    • https://corbo.ru/images/free-roblox-vpn.pdfIn PDF document text
    • http://verenacrow.at/images/how-to-hack-in-roblox-2021-jailbreak.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/loli-hacks-roblox-exploit.pdfIn PDF document text
    • http://huananhai.net/images/free-robux-gift-cards-live-now.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/working-robux-hack-without-a-human-verification.pdfIn PDF document text
    • https://semanasantacehegin.com/images/robloxlover69-how-to-get-free-robux.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/roblox-cute-girl-outfits-for-free.pdfIn PDF document text
    • http://dottgagliardi.com/images/hack-robar-cuentas-de-roblox-2021-pastebin-akaka.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/como-tener-400-robux-gratis-sin-hack.pdfIn PDF document text
    • http://www.anies.eu/images/free-robux-ad.pdfIn PDF document text
    • http://atelierweb.it/images/roblox-hack-to-get-robux-2021.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/roblox-invisible-hack-2021.pdfIn PDF document text
    • https://www.abrapppe.org.br/images/how-do-you-get-free-robux.pdfIn PDF document text
    • https://reggieslockandkey.com/images/for-roblox-launch-for-free-vip.pdfIn PDF document text
    • https://gestionpatrimonial.net/images/roblox-free-without-installing.pdfIn PDF document text
    • http://legs11.co.za/images/dio-roblox-free-shop-t-schirts.pdfIn PDF document text
    • https://www.ukrtrans.biz/images/how-to-get-free-robux-on-android-phone.pdfIn PDF document text
    • http://mycounty.com.ua/images/rbx-robux-free.pdfIn PDF document text
    • http://portal.crfsp.org.br/images/free-robux-glitch-july-2021.pdfIn PDF document text
    • http://hotel-buta.by/images/free-robux-advertisment-site.pdfIn PDF document text
    • http://dottgagliardi.com/images/how-do-you-get-a-free-dominus-in-roblox.pdfIn PDF document text
    • https://ambarevleri.com/images/roblox-hack-deutsch-pc-2021.pdfIn PDF document text
    • http://kruiz21.ru/images/free-game-items-roblox.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/free-robux-call.pdfIn PDF document text
    +12 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000087dc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x87DC 26980 bytes
SHA-256: f790b4af8098f4b66953cabc425b25cc561dc8e1ec321429f6a334a0c1827c40
font_01_sfnt_off0000c5dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5DD 18732 bytes
SHA-256: b105ba16359b381bbca3e169d16183eefc797d50653fffaabd16797abef103fa