Malicious PDF — malware analysis report

Static analysis result for SHA-256 d70c4a1de8ad4a02…

MALICIOUS

PDF

54.0 KB Created: 2021-04-06 15:39:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: a0518f2619bc9970449165ba3a03ea3b SHA-1: 3c866f368b806b0b3f7fa4c00a556ac56bab56f8 SHA-256: d70c4a1de8ad4a029181c88e03a9ff5e8eeabaedd7baf5fd76623e9007b62af1
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple links and a call-to-action in its body text, all directing users towards websites promising free Robux or game hacks. The primary lure URL is 'https://enigmagenerator.com/app/431946152/roblox-game-hack'. While no scripts were explicitly extracted, the PDF structure and embedded links strongly suggest a social engineering tactic to redirect users to potentially malicious sites, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8413

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://act.gr/images/how-to-get-free-robux-2021.pdfIn PDF document text
    • http://stitchingart.com/images/hack-in-booga-booga-roblox.pdfIn PDF document text
    • https://reggieslockandkey.com/images/how-to-hack-a-old-roblox-account.pdfIn PDF document text
    • https://www.albisser.ch/images/how-to-cheat-in-money-in-roblox.pdfIn PDF document text
    • http://rushxpress.de/images/cheat-roblox-jailbreak-tembus-2021.pdfIn PDF document text
    • http://reisebild.eu/images/robux-for-free-on-ipad.pdfIn PDF document text
    • http://possumholler.us/images/cuentas-gratis-de-roblox-hacks.pdfIn PDF document text
    • http://greasley.website/images/free-roblox-commands.pdfIn PDF document text
    • http://bibliodetki.ru/images/hack-robux-using-goo.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/how-to-hack-roblox-jailbreak-2021.pdfIn PDF document text
    • http://www.sitiamministrabili.it/images/free-robux-codes-4-500-2021.pdfIn PDF document text
    • http://alpen-seeblick.at/images/how-to-get-free-tix-on-roblox.pdfIn PDF document text
    • http://www.maakherumusic.net/images/hack-portal-heroes-roblox.pdfIn PDF document text
    • http://maxvanberchem.org/images/roblox-meep-city-free-items.pdfIn PDF document text
    • https://meltonschool.org/images/free-bombox-on-roblox.pdfIn PDF document text
    • http://www.campiresine.it/images/como-dibujar-en-free-draw-roblox.pdfIn PDF document text
    • http://www.conservatoriolecce.it/images/how-do-i-hack-robux-by-myself.pdfIn PDF document text
    • http://5346000.com/images/roblox-robux-free-robux.pdfIn PDF document text
    • http://lv-siegen.de/images/free-roblox-music-id.pdfIn PDF document text
    • https://europainstitut.hu/images/roblox-how-to-make-ur-self-look-good-for-free.pdfIn PDF document text
    • http://pourvosvacances.com/images/free-robux-in-roblox-real.pdfIn PDF document text
    • http://androidthai.in.th/images/all-free-clothes-in-roblox.pdfIn PDF document text
    • http://www.ntc.edu.za/images/hacks-roblox-skywars.pdfIn PDF document text
    • http://gaeconsultores.cl/images/roblox-owo-t-shirt-free.pdfIn PDF document text
    • http://internetdeputy.com/images/easiest-way-to-upload-audio-on-roblox-for-free-2021.pdfIn PDF document text
    • http://www.vktzunami.cz/images/roblox-account-with-robux-free.pdfIn PDF document text
    • http://stroygrad-spb.com/images/free-roblox-accounts-free-right-now.pdfIn PDF document text
    • http://almacargo.com/images/free-robux-armanda.pdfIn PDF document text
    • http://www.zdravazena.sk/images/how-ot-get-free-robux-nathoric.pdfIn PDF document text
    • https://www.stayon.no/images/roblox-card-free-fake-it.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/roblox-cheat-engine-64-robux.pdfIn PDF document text
    • http://webstan.be/images/free-roblox-accounts-with-robux-2021-may.pdfIn PDF document text
    • https://www.cfdcnv.com/images/roblox-the-dump-work-at-a-pizza-place-money-hacks.pdfIn PDF document text
    • https://estalagemmonteverde.com.br/images/how-to-get-free-robux-combo.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/bleu-roblox-hack.pdfIn PDF document text
    • https://www.milewood.co.uk/images/how-to-get-free-robux-without-downloading-apps-for-ios.pdfIn PDF document text
    • https://www.lomrad.go.th/images/how-to-hack-roblox-2021-trackid-sp006.pdfIn PDF document text
    • http://xn-----clcdhzcbmgnochhb1boe1a6b.xn--p1ai/images/frost-guard-general-roblox-free.pdfIn PDF document text
    • https://sitam.co.in/images/hack-roblox-blob-simulator.pdfIn PDF document text
    • http://chartsmart.com.au/images/impact-roblox-hack-website.pdfIn PDF document text
    • http://pdapanache.com/images/roblox-bin-hacked.pdfIn PDF document text
    • http://ilijakom.com/images/roblox-exploit-hack-download-2021.pdfIn PDF document text
    • https://www.gvandenakker.nl/images/hack-roblox-2021-17-de-junio.pdfIn PDF document text
    • http://androidthai.in.th/images/roblox-jailbreak-redboy-hack.pdfIn PDF document text
    • http://www.lionel-seppoloni.fr/images/free-hair-roblox-not-decal.pdfIn PDF document text
    • http://onlinemusicsolutions.com.au/images/how-to-hack-roblox-jailbreak-on-android.pdfIn PDF document text
    • http://www.gongoff.com/images/cheat-tool-roblox.pdfIn PDF document text
    • http://petarda.hu/images/adidas-roblox-shirt-free-design-high-resoulution.pdfIn PDF document text
    • https://hekl-software.de/images/free-copy-hack-roblox.pdfIn PDF document text
    +8 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006e7c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6E7C 28300 bytes
SHA-256: d95c635ec190cdfaa64e307912d7df5e63654c910aadb1d46f410c3bd2381537
font_01_sfnt_off0000af8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAF8A 18212 bytes
SHA-256: 54c21eac1ba6d2cd5fc890d31ec244be33cd53a16303f63d3eeceaff1d777f7b

Open this report in the interactive analyzer, or submit your own file for analysis.