Malicious PDF — malware analysis report

Static analysis result for SHA-256 df19f613b8ea7d93…

MALICIOUS

PDF

240.1 KB Created: 2021-04-04 22:53:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: db1da10584a84f288a3459b494bb8bca SHA-1: db819e90fe114f023f94c263d6678c90ae945764 SHA-256: df19f613b8ea7d93ea8681192436ac2a2aa478c15186ebc898202902b9a3ef8d
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5773

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/top-10-type-hacker-roblox PDF link annotation
    • https://pagadder.com/images/how-to-make-cheat-engine-undetected-on-roblox.pdfIn PDF document text
    • http://pourvosvacances.com/images/free-robux-no-offers-or-verification.pdfIn PDF document text
    • https://studentcareerinfo.com/images/free-robux-giveaway-live-youtube.pdfIn PDF document text
    • http://w-i-r.de/images/hacker-gamepass-roblox.pdfIn PDF document text
    • http://eltisstudio.sk/images/cheat-on-roblox-ghost-simulattor.pdfIn PDF document text
    • https://koeltotaal.com/images/how-to-get-free-outrageous-builders-club-on-roblox-2021.pdfIn PDF document text
    • http://kaleasm.org/images/free-robux-decal-roblox.pdfIn PDF document text
    • http://76remont-kvartir.ru/images/roblox-project-pokemon-hack-vermillion.pdfIn PDF document text
    • http://jobsy.com.sg/images/free-robux-by-doing-nothing.pdfIn PDF document text
    • https://zabota-kashira.ru/images/cheat-codes-vehicle-simulator-roblox.pdfIn PDF document text
    • https://open-coffee-drimmelen-geertruidenberg.nl/images/free-de-la-hoya-pants-roblox.pdfIn PDF document text
    • https://vtvvaals.nl/images/hack-robux-codes.pdfIn PDF document text
    • http://homequeen.de/images/robux-hack-whith-easy-human-verifacation.pdfIn PDF document text
    • http://www.brtes.com/images/cbro-roblox-hack.pdfIn PDF document text
    • http://scuttworksdesigns.us/images/roblox-install-free-mac.pdfIn PDF document text
    • http://moralcenter.or.th/images/free-admin-commands-for-roblox.pdfIn PDF document text
    • http://iluvlocalplaces.com/images/roblox-how-to-get-free-robux-real.pdfIn PDF document text
    • https://digitalsenseafrica.com.ng/images/roblox-hack-codes-2021.pdfIn PDF document text
    • http://goosesscuba.com/images/robux-hack-without-installing-apps.pdfIn PDF document text
    • http://arcnjournals.org/images/free-draw-2-roblox-kick-people.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00036aba.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x36ABA 21756 bytes
SHA-256: e6bbbe2325ea3f99dddd425a0cef2a7d4cf271fafd6dcb4c7ebef8fca8081630
font_01_sfnt_off00039a40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39A40 18188 bytes
SHA-256: 5f2f84826869e0ff7a162a17ff20f220e87da0262413206648e95188faa4b185

Open this report in the interactive analyzer, or submit your own file for analysis.