Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd335d3a96b12a19…

MALICIOUS

PDF

57.9 KB Created: 2021-04-05 18:11:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 87b35f1b7335acf15325ad1856ea70d5 SHA-1: 0801f9f70e429e1e310742ad0a80549375edf7b8 SHA-256: dd335d3a96b12a19e4ca75f283c6f0cb1c806231daf58beec00ed4bcf62f7f46
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF document uses social engineering tactics, impersonating Amazon to trick users into downloading a 'Roblox Hack'. Heuristics indicate it's a browser extension installation lure and a password-protected archive lure, suggesting the user is prompted to download and potentially decrypt a malicious payload. The primary malicious URL identified is http://gaminggenerator.org/app/431946152/lawn-mowing-simulator-roblox-hack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 6

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/lawn-mowing-simulator-roblox-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/lawn-mowing-simulator-roblox-hack PDF link annotation
    • https://www.millatgears.com/images/how-to-get-free-roblox-items.pdfIn PDF document text
    • http://axiapublishers.com/images/easy-robux-hack-on-android.pdfIn PDF document text
    • https://gaj.rs/images/what-is-the-april-1st-stickmasterluke-hack-face-roblox-called.pdfIn PDF document text
    • http://stroygrad-spb.com/images/roblox-how-to-get-a-group-for-free.pdfIn PDF document text
    • http://ferienwohnung-walker.de/images/how-to-earn-robux-for-free-2021.pdfIn PDF document text
    • https://www.lavigny.ch/images/400-robux-free.pdfIn PDF document text
    • http://www.hotelcomelico.it/images/free-robux-codes-2021-august.pdfIn PDF document text
    • https://schulzpressetext.de/images/how-to-hack-roblox-deathrun.pdfIn PDF document text
    • https://abouttimetech.com/images/again-here-for-free-robux-on-roblox-com-free4mobile24-com.pdfIn PDF document text
    • http://medimacs.eu/images/robux-free-codes-2021.pdfIn PDF document text
    • https://amatq.ca/images/sign-up-for-free-robux.pdfIn PDF document text
    • https://www.tsdb.com.au/images/roblox-free-account-biz.pdfIn PDF document text
    • http://fotoflas.gr/images/i-love-cats-shirt-roblox-free.pdfIn PDF document text
    • http://www.copoint.co.uk/images/free-items-catalog-roblox.pdfIn PDF document text
    • http://bufbd.org/images/accessory-hat-ashs-hat-on-roblox-free.pdfIn PDF document text
    • https://beejekorf.nl/images/cheats-to-get-money-on-roblox-woodson.pdfIn PDF document text
    • http://www.guidaturisticaverona.it/images/b-tool-hack-in-roblox-link.pdfIn PDF document text
    • http://news123.it/images/free-roblox-steamy-xxx-videos-lol.pdfIn PDF document text
    • https://verdensbarn.no/images/free-no-verification-robux-generator.pdfIn PDF document text
    • https://verdensbarn.no/images/pastebin-unlimited-free-robux-and-obc-on-roblox-2021.pdfIn PDF document text
    • https://sitam.co.in/images/roblox-robux-generator-2021-free-download-no-surveys.pdfIn PDF document text
    • https://www.colditex.com/images/how-to-get-free-money-in-roblox-jailbreak-2021.pdfIn PDF document text
    • https://bancroftandsons.com/images/roblox-hack-after-update-1608.pdfIn PDF document text
    • http://domaizdereva24.ru/images/free-download-roblox-for-android-phone.pdfIn PDF document text
    • https://www.cpnf.ch/images/how-get-free-roblox.pdfIn PDF document text
    • https://verdensbarn.no/images/how-to-hack-dragon-ball-rage-roblox-2021.pdfIn PDF document text
    • http://behsanroshd.com/images/free-robux-hack-2021-lenovo.pdfIn PDF document text
    • http://dialine.cz/images/free-roblox-studio-library.pdfIn PDF document text
    • http://evp-sanorlenok.ru/images/how-to-get-free-faces-on-roblox.pdfIn PDF document text
    • http://www.hawler.in/images/roblox-new-shoot-through-walls-hack.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/roblox-hacks-download-mac.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/roblox-hat-free-2021.pdfIn PDF document text
    • https://studentcareerinfo.com/images/lifting-simulator-roblox-new-hack.pdfIn PDF document text
    • http://addair.co.uk/images/how-to-get-free-turbo-builders-club-on-roblox.pdfIn PDF document text
    • http://kim-kinder-im-mittelpunkt.de/images/how-to-hack-anything-in-roblox.pdfIn PDF document text
    • http://rumler.pl/images/stella-roblox-hack-buy.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/how-to-hack-roblox-copy-any-roblox-game.pdfIn PDF document text
    • http://ivalor.fr/images/guuudinfo-robux-hack-no-persinal-infomation.pdfIn PDF document text
    • http://auto-mankel.de/images/free-balloon-pauldrons-on-roblox.pdfIn PDF document text
    • http://news123.it/images/free-roblox-stuff-catalog.pdfIn PDF document text
    • https://www.hotschool.com.au/images/what-is-the-robux-hex-value-in-cheat-engine.pdfIn PDF document text
    • https://www.stkdb.cz/images/telecharger-roblox-hack-apk.pdfIn PDF document text
    • https://www.abrapppe.org.br/images/free-robux-2021-no-survey.pdfIn PDF document text
    • https://www.cpnf.ch/images/play-roblox-for-free-online-now.pdfIn PDF document text
    • https://www.albisser.ch/images/how-to-get-a-free-dominus-roblox.pdfIn PDF document text
    • https://pemadamapi.net/images/free-robux-download-no-virus.pdfIn PDF document text
    • http://brandyourbody.com/images/roblox-hack-mobile-generator.pdfIn PDF document text
    • http://texnes-plus.gr/images/cheat-codes-for-free-stuff-roblox.pdfIn PDF document text
    • http://africadaily.co.za/images/free-robux-by-doing-nothing.pdfIn PDF document text
    +14 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000081fd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x81FD 25700 bytes
SHA-256: 2f20ab1d3bd33bd0d86ddfbd5c4be03a770f3299e0c6edb9240503c44c44dfba
font_01_sfnt_off0000bd1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD1B 18860 bytes
SHA-256: 8ec49de649022794bf49f484ad95d3cd623cfe680d65ac3952c18e61842626a6