Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc7424fc1feba54c…

MALICIOUS

PDF

53.0 KB Created: 2021-04-06 09:04:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 0ee7b0880b91e84b707ec855649f25b7 SHA-1: 1a415bc3aa63d2728f46cd3de91b02d4f2cd388d SHA-256: dc7424fc1feba54ccad876644b84cddd09f832b4c1a32330dc5aaee044ec9f71
110 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple heuristics indicating it is a lure for game hacks, specifically targeting Roblox players. The document body and embedded URLs point to websites offering 'free Robux' or 'game hacks', with the primary URL being http://enigmagenerator.com/app/431946152/roblox-game-hack. This suggests the PDF is designed to trick users into visiting malicious sites or downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8721

Heuristics 5

  • PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://www.sapaengineering.kz/images/roblox-dll-hacks-2021.pdfIn PDF document text
    • http://www.torvet11.dk/images/free-robux-no-password-or-human-verification-2021.pdfIn PDF document text
    • http://www.drent.se/images/roblox-free-stuff-hack.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/how-to-hack-roblox-death-zone.pdfIn PDF document text
    • https://www.hbproducts.dk/images/comandos-de-free-admin-roblox.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/free-reedeem-code-roblox.pdfIn PDF document text
    • https://rieber-transporte.de/images/how-to-get-robux-with-cheat-engine-63.pdfIn PDF document text
    • http://berntfoto.dk/images/roblox-money-cheats-for-rocitizens.pdfIn PDF document text
    • https://sanjoseelectricians.net/images/hacker-scp-roblox.pdfIn PDF document text
    • http://dubwar.pl/images/free-1-000-robux.pdfIn PDF document text
    • http://nevesomost.by/images/roblox-speed-hack-2021-download.pdfIn PDF document text
    • http://eau-petit-pont.com/images/surprise-texting-hacked-roblox.pdfIn PDF document text
    • http://laboraltoledo.com/images/free-roblox-outfits-2021.pdfIn PDF document text
    • https://yarburservices.ru/images/how-to-hack-into-roblox-account-with-method.pdfIn PDF document text
    • https://gomsa.nl/images/hacking-become-admin-roblox.pdfIn PDF document text
    • http://maxvanberchem.org/images/free-roux-roblox.pdfIn PDF document text
    • http://ivpr.net/images/cheat-in-roblox-free-robux.pdfIn PDF document text
    • http://immo360grad.com/images/roblox-free-to-take-group.pdfIn PDF document text
    • http://saip.ws/images/roblox-banned-for-hacking.pdfIn PDF document text
    • http://www.pro-futuro.eu/images/roblox-hacks-download-2021-with-virus-total.pdfIn PDF document text
    • http://akademiatenisa.org/images/how-to-upload-free-audio-to-roblox.pdfIn PDF document text
    • http://www.actae.gr/images/roblox-account-hacken.pdfIn PDF document text
    • http://www.visiblefilm.com/images/god-mode-roblox-hack.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/how-to-get-a-lot-of-robux-for-free-2021.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/how-to-hack-roblox-build-a-boat-for-treasure.pdfIn PDF document text
    • http://echosvoix.ch/images/hacker-robux-2021.pdfIn PDF document text
    • http://www.mosaikshop.at/images/robux-hack-website.pdfIn PDF document text
    • http://akademiatenisa.org/images/script-for-free-robux-vid.pdfIn PDF document text
    • http://apostolosandreaslemesou.com/images/roblox-free-robux-no-survey-no-verification.pdfIn PDF document text
    • http://www.remiauclair.fr/images/break-free-by-ariana-grande-roblox-id.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/cache-http-robuxiancom-howtogetfreerobuxv8.pdfIn PDF document text
    • http://stackideas.com/images/free-robux-codes-september-2021.pdfIn PDF document text
    • https://www.millatgears.com/images/dungeon-quest-roblox-farming-hack.pdfIn PDF document text
    • http://sbm-nn.ru/images/roblox-cheat-engine-how-to-get-robux.pdfIn PDF document text
    • http://parsbaft.com/images/roblox-shinobi-life-level-hack.pdfIn PDF document text
    • http://instrumenttut.by/images/free-robux-with-just-a-click.pdfIn PDF document text
    • http://muko-unterfranken.info/images/hacks-for-arsenal-roblox-mega.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/roblox-case-clicker-cheat-engine.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/roblox-restaurant-tycoon-hacks.pdfIn PDF document text
    • http://greasley.online/images/roblox-cheat-wall-glitch-hack.pdfIn PDF document text
    • http://brinicombe.co.uk/images/free-dominus-roblox-script.pdfIn PDF document text
    • http://bertaluzorganiccosmetics.com/images/hack-robux-cheats.pdfIn PDF document text
    • http://the-specials.ch/images/roblox-new-shoot-through-walls-hack.pdfIn PDF document text
    • http://bagna.pl/images/how-to-hack-and-get-robux-site-youtubecom.pdfIn PDF document text
    • http://indotec.fr/images/roblox-money-cheat-bloxburg.pdfIn PDF document text
    • http://eventgo.fr/images/rbxrich-free-robux.pdfIn PDF document text
    • http://southernhills-golf.com/images/hack-apk-roblox.pdfIn PDF document text
    • http://ghegamethu.vn/images/how-to-get-roblox-money-cheat.pdfIn PDF document text
    • http://www.torvet11.dk/images/free-robux-no-password-or-human-In PDF document text
    +13 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00006ee1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6EE1 26620 bytes
SHA-256: 6cd8985d2131246fe4b1d5d7750ff07f3fd9ee6674613d634f33b98b51c9a765
font_01_sfnt_off0000acda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACDA 17860 bytes
SHA-256: 1ed15512293927cee7cbec2a894f43a1ac63fc49ac307393c4101705c03cefdf

Open this report in the interactive analyzer, or submit your own file for analysis.