Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2ef16c5a38e1060…

MALICIOUS

PDF

52.1 KB Created: 2021-04-06 15:51:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-22
MD5: e08d0fae02ab6faa0fd318ec98aa37b6 SHA-1: c8ae70384bbc914bc278fd141024afd1a72e74bf SHA-256: d2ef16c5a38e1060b9886034eb354480a179e64dcea2303c7859b86541dac91e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple heuristics indicating it's a lure for game hacks, specifically targeting Robux. The primary link directs to 'enigmagenerator.com', which is flagged as a redirector for game hacks. While no scripts were directly extracted, the PDF structure and embedded URIs strongly suggest a malicious intent to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8896

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • https://verdensbarn.no/images/how-to-hack-roblox-account-top-9ways.pdfIn PDF document text
    • http://eventgo.fr/images/how-to-hack-robux-with-cheat-engine.pdfIn PDF document text
    • http://vipservice-bg.com/images/roblox-free-gift-card-com.pdfIn PDF document text
    • http://www.exikom.com.ua/images/android-hacks-roblox.pdfIn PDF document text
    • http://unc-europe.com/images/how-yo-get-more-money-on-roblox-cheat.pdfIn PDF document text
    • http://seytarehco.com/images/hackear-xuents-de-robux-de-un-amigo.pdfIn PDF document text
    • http://laboraltoledo.com/images/yandex-disk-download-744d2021b6-robux-cheat-trs-rar-html.pdfIn PDF document text
    • http://boliviagasenergia.com/images/bloxburg-hack-roblox-pastebin.pdfIn PDF document text
    • http://www.copoint.co.uk/images/free-robux-by-bananaman.pdfIn PDF document text
    • https://www.belgium-archery.be/images/hacks-de-roblox-booga-booga.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/cheat-roblox-bee-swarm-simulator.pdfIn PDF document text
    • https://koeltotaal.com/images/roblox-hutt-cartel-tatooine-free.pdfIn PDF document text
    • http://ernstgloves.co.il/images/hacks-for-roblox-mining-simulator.pdfIn PDF document text
    • http://msfs-eastafrica.com/images/roblox-pet-simulator-hack-script-pastebin.pdfIn PDF document text
    • https://www.milewood.co.uk/images/inspect-to-get-free-robux.pdfIn PDF document text
    • https://gryps.de/images/roblox-admin-hack-any-server-unpached.pdfIn PDF document text
    • http://learningarabic.co.uk/images/free-robux-codes-on-camera.pdfIn PDF document text
    • http://seminolechapter.com/images/roblox-builder-club-free-code.pdfIn PDF document text
    • http://huebner-baustoffe.de/images/reel-hack-for-roblox-jailbreak.pdfIn PDF document text
    • http://citycare.pt/images/free-skin-in-roblox-2021.pdfIn PDF document text
    • https://www.ergolight.at/images/free-robux-2021-generator-no-human-verification.pdfIn PDF document text
    • http://teknotools.net/images/cool-hacks-for-roblox.pdfIn PDF document text
    • https://uofk.edu/images/how-to-hack-someones-roblox-password.pdfIn PDF document text
    • http://towtrucklosangeles.com/images/robuxian-hack-roblox.pdfIn PDF document text
    • http://eooe.gr/images/free-robux-and-tix-2021.pdfIn PDF document text
    • https://asesoriamss.com/images/do-you-get-free-robux-when-you-work-for-roblox.pdfIn PDF document text
    • http://reisebild.eu/images/roblox-uno-hack.pdfIn PDF document text
    • http://schrichte.de/images/how-to-get-a-free-skin-roblox-avatar.pdfIn PDF document text
    • http://asinpro.net/images/hack-para-volar-en-roblox-2021.pdfIn PDF document text
    • https://javisintlmedia.com/images/free-flow-roblox.pdfIn PDF document text
    • http://zarinnameh.ir/images/roblox-how-to-get-ninja-animation-for-free.pdfIn PDF document text
    • http://urezerv.com/images/cheat-roblox-prison-life.pdfIn PDF document text
    • http://fiur-malermeister.de/images/free-roblox-13-accounts.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/top-free-commands-in-roblox-which-works-in-all-games.pdfIn PDF document text
    • http://neltalen.nl/images/can-any-codes-give-u-free-robux.pdfIn PDF document text
    • http://atelierweb.it/images/roblox-gun-hack.pdfIn PDF document text
    • http://salantiskis.lt/images/dont-tell-anyone-about-this-free-robux-glitch-july-2021.pdfIn PDF document text
    • https://gastroration.ru/images/como-hackear-cuentas-de-roblox-con-programas.pdfIn PDF document text
    • http://domaizdereva24.ru/images/roblox-prison-life-hack-2021.pdfIn PDF document text
    • http://dos.most.gov.la/images/roblox-sign-up-free-online.pdfIn PDF document text
    • http://pia2000.net/images/adfly-roblox-hack.pdfIn PDF document text
    • http://glll.de/images/202100-robux-promo-code-free.pdfIn PDF document text
    • http://uo-nn.ru/images/robux-hack-with-required-password.pdfIn PDF document text
    • http://cadcam.no/images/nisterv-free-robux-hack.pdfIn PDF document text
    • http://depelem.fr/images/5-roblox-games-that-give-free-items.pdfIn PDF document text
    • https://pa-waingapu.go.id/images/free-robux-and-tix-generator-no-survey.pdfIn PDF document text
    • https://plumbingmedics.com/images/roblox-insta-arrest-hack-jailbreak.pdfIn PDF document text
    • http://smoothjazzclub.net/images/free-roblox-money-hack.pdfIn PDF document text
    • http://elize-photography.co.za/images/fast-free-robux.pdfIn PDF document text
    +15 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006da2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DA2 25492 bytes
SHA-256: e9fd00f177cea249a27cf99f925136a33036c6104e34f9b364249e084f4b4b71
font_01_sfnt_off0000a6a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA6A3 18684 bytes
SHA-256: db8d23c11fd52accd71e452c20bb5c8daeea4d5009b4063ed6d7b3fffcb83a5d

Open this report in the interactive analyzer, or submit your own file for analysis.