Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0140bf1c2c29634…

MALICIOUS

PDF

53.3 KB Created: 2021-04-06 23:32:27 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 11e4ad5af3b0951b5f3952211f909765 SHA-1: 6aa7339037e912aeac73e973152f84dd033fc185 SHA-256: e0140bf1c2c296342bdc7c233234034b301cda037463a60f65dc808b4e68c63d
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8721

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • http://palogar.es/images/how-to-get-free-faces-on-roblox-2021-no-download.pdfIn PDF document text
    • http://www.arredifunebri.com/images/www-roblox-com-free-play.pdfIn PDF document text
    • http://bunadsmaria.com/images/where-to-get-a-lot-of-robux-for-free.pdfIn PDF document text
    • http://www.anies.eu/images/best-way-how-to-change-your-roblox-username-for-free.pdfIn PDF document text
    • https://www.stayon.no/images/how-to-free-robux-codes.pdfIn PDF document text
    • https://datavoiz.com/images/how-to-get-a-roblox-hat-for-free.pdfIn PDF document text
    • http://lillysonthelake.com/images/appkarma-free-robux.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/how-to-make-time-freeze-in-roblox-free-admin-hangouts.pdfIn PDF document text
    • http://horsa18.ru/images/free-script-executor-roblox-2021.pdfIn PDF document text
    • http://moto98.com/images/which-are-the-best-free-level-7-exploits-for-roblox.pdfIn PDF document text
    • https://studentcareerinfo.com/images/free-robux-giveaway-live-youtube.pdfIn PDF document text
    • http://federcaccianucleomagenta.it/images/how-do-you-hack-through-walls-in-roblox-jailbreak.pdfIn PDF document text
    • http://bullyinformate.org/images/roblox-free-account-generator.pdfIn PDF document text
    • https://academy.cr/images/ip-grabber-hack-for-roblox.pdfIn PDF document text
    • https://www.coriglianocalabro.it/images/gcomment-hacker-strucid-roblox.pdfIn PDF document text
    • http://beaksandpawsfl.com/images/how-to-open-cheat-engine-in-roblox-2021.pdfIn PDF document text
    • http://beagles-of-harmony.de/images/free-pc-games-like-roblox.pdfIn PDF document text
    • http://www.rezbb.sk/images/how-to-get-the-elite-radio-in-roblox-free.pdfIn PDF document text
    • http://www.lionel-seppoloni.fr/images/how-to-get-1m-robux-free-everyday.pdfIn PDF document text
    • http://muko-unterfranken.info/images/hacks-para-roblox-2021-descargar.pdfIn PDF document text
    • https://www.mvp.co.nz/images/free-now-for-free-robux.pdfIn PDF document text
    • http://linens.kiev.ua/images/roblox-meme-hack-2021.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/zombie-attack-roblox-cheat-engien.pdfIn PDF document text
    • http://ecoleduchat-grenoble.fr/images/hack-client-for-roblox.pdfIn PDF document text
    • http://hcberg.com/images/free-roblox-jailbreak-money.pdfIn PDF document text
    • https://beejekorf.nl/images/how-to-get-free-robux-with-a-fake-creditcard.pdfIn PDF document text
    • https://sectorpravdy.com/images/glitch-for-free-robux-2021.pdfIn PDF document text
    • http://sfera-express.ru/images/roblox-cheats-to-be-able-to-say-numbers.pdfIn PDF document text
    • https://www.cfdcnv.com/images/roblox-booga-booga-mojo-hack.pdfIn PDF document text
    • http://haertetechnik-steinbach.de/images/download-cheat-roblox-pc.pdfIn PDF document text
    • http://indotec.fr/images/free-no-robux-account.pdfIn PDF document text
    • http://babyxpress.de/images/hack-roblox-secret.pdfIn PDF document text
    • http://www.pro-futuro.eu/images/free-robux-card-number-enter-code.pdfIn PDF document text
    • http://armatrutz.de/images/john-doe-roblox-hacking.pdfIn PDF document text
    • http://pythonbikers.de/images/how-to-get-free-plus-on-roblox.pdfIn PDF document text
    • http://jdlrelocation.com/images/free-robux-promo-codes-february-2021-not-expired.pdfIn PDF document text
    • http://chjames.com.au/images/roblox-free-script-executor-2021.pdfIn PDF document text
    • https://www.archimadrid.org/images/free-robux-hack-no-survey-no-download-2021.pdfIn PDF document text
    • https://www.brainpads.com/images/robux-hack-with-no-verification.pdfIn PDF document text
    • https://grovehilloutfitters.com/images/boku-no-roblox-remastered-quirk-hack.pdfIn PDF document text
    • http://ofthalmiatrosthess.gr/images/roblox-dbo-stat-hack.pdfIn PDF document text
    • http://clinicadentalvilaplana.es/images/hacked-script-roblox.pdfIn PDF document text
    • http://www.ntc.edu.za/images/new-hack-for-roblox-2021-novemeber.pdfIn PDF document text
    • http://escolaarboc.cat/images/how-to-promote-your-roblox-game-for-free.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/roblox-fun-com-free-robux-generator.pdfIn PDF document text
    • http://drozle.lt/images/free-robux-cards-no-verification.pdfIn PDF document text
    • http://biotronicscyprus.com/images/how-to-hack-roblox-with-crosh.pdfIn PDF document text
    • http://famoirs.co.uk/images/twitter-free-gift-card-codes-roblox.pdfIn PDF document text
    • http://ivanitskyvs.ru/images/how-to-get-free-robux-t.pdfIn PDF document text
    +16 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000070d9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x70D9 27380 bytes
SHA-256: 261505fbe9dce60c7d04d37d471c94dc33e0cc075ac850fa317775efb41e6f22
font_01_sfnt_off0000ac63.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAC63 18368 bytes
SHA-256: e317abd1d89fbebb45064353c9bfd3740a3927c7864ed504d8feede424c414ff

Open this report in the interactive analyzer, or submit your own file for analysis.