Malicious PDF — malware analysis report

Static analysis result for SHA-256 d56d5ca6683a76fa…

MALICIOUS

PDF

240.3 KB Created: 2021-04-04 23:19:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-26
MD5: fb9fa9b0750e87700abd74a5ba5db4d3 SHA-1: 9e1b121ebf36a9ed2c1a6898bdcd2032eb4a01d9 SHA-256: d56d5ca6683a76fab1411f187149fa4fba1b9abfdadb4c53ff95e34a0039495e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is identified as a malicious PDF by ClamAV and an ML classifier, with a heuristic indicating an external URI related to Roblox games. The document body, though heavily obfuscated, contains references to 'Free Online Roblox Tornado Games', suggesting a lure. The presence of an external URI and the nature of the lure point towards a phishing attempt to trick users into downloading a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5773

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-online-roblox-tornado-games PDF link annotation
    • https://www.dachytarasowe.eu/images/how-to-get-shirts-free-on-roblox.pdfIn PDF document text
    • https://www.nema.go.ke/images/tiny-tanks-roblox-hack-2021.pdfIn PDF document text
    • http://only1you.ru/images/my-roblox-account-was-hacked-and-it-chagned-my-passowrd.pdfIn PDF document text
    • http://mydevice.com.au/images/roblox-girl-free.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/how-to-hack-roblox-account-password.pdfIn PDF document text
    • http://fiur-malermeister.de/images/websites-for-free-robux-without-human-verification.pdfIn PDF document text
    • http://santjoandelesabadesses.cat/images/robuxian-robux-hack-2021.pdfIn PDF document text
    • http://unionmusicaldebenidorm.com/images/install-hacked-roblox.pdfIn PDF document text
    • http://domaizdereva24.ru/images/robux-hack-2021-october.pdfIn PDF document text
    • https://verdensbarn.no/images/how-to-make-your-roblox-character-aesthetic-for-free.pdfIn PDF document text
    • https://scraperite.com/images/roblox-cheat-engine-walk-speed.pdfIn PDF document text
    • https://sectorpravdy.com/images/dragon-riders-roblox-hack.pdfIn PDF document text
    • http://tehergumi.hu/images/3-games-to-get-free-robux.pdfIn PDF document text
    • http://greenoase.be/images/roblox-script-hack-get-everything.pdfIn PDF document text
    • https://bgescc.com/images/cheat-engine-64-roblox-bypass.pdfIn PDF document text
    • https://piscinasmundoacuatico.com/images/free-robux-hack-com-no-human-verification.pdfIn PDF document text
    • http://subarulegacy.com/images/roblox-cheat-android-1.pdfIn PDF document text
    • http://behsanroshd.com/images/how-to-get-obc-and-robux-for-free-2021.pdfIn PDF document text
    • http://texnes-plus.gr/images/how-to-get-free-roblox-limiteds.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/roblox-hack-2021-free-robux-generator.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00036aec.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x36AEC 21888 bytes
SHA-256: 2df75a76d181cc1040cee9513bddd66bbfa861b6491b840081b7a92ad128a61b
font_01_sfnt_off00039b2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39B2E 18316 bytes
SHA-256: c87c0eb48e9381f2b3c3609a0be1e286d246a3a8cbd7cadb7835c8824512e565

Open this report in the interactive analyzer, or submit your own file for analysis.