Malicious PDF — malware analysis report

Static analysis result for SHA-256 e02a386f1421a0eb…

MALICIOUS

PDF

35.2 KB Created: 2021-04-05 17:41:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: d2c25ec666e2639f07d37ff69ef58f04 SHA-1: d16c2b9c11b63dd2041f10a6d9fba1296578751b SHA-256: e02a386f1421a0ebf9b994cb47abdab3d2c977f0f282313d991d3b431a246ff3
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

This PDF document was flagged as malicious by an ML classifier. It uses brand-impersonation credential phishing. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/free-legit-robux-apps.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-legit-robux-apps PDF link annotation
    • https://letturatarghe.it/images/how-to-get-free-robux-2021-not-patched.pdfIn PDF document text
    • http://aimp-market.ru/images/free-roblux-for-roblox.pdfIn PDF document text
    • https://ai-appenzell.ch/images/roblox-valentine-generator-free-robux.pdfIn PDF document text
    • http://www.fanciullovito.it/images/roblox-hack-999999-robux-ios.pdfIn PDF document text
    • https://www.quistschoenenhalsteren.nl/images/roblox-202120214-for-free.pdfIn PDF document text
    • http://zercalo.org/images/how-to-cheat-in-roblox-robux-2021.pdfIn PDF document text
    • http://mklista.ru/images/free-way-to-get-free-robux-in-roblox.pdfIn PDF document text
    • http://dshikr.ru/images/hack-script-roblox-build-a-boat.pdfIn PDF document text
    • http://feuerwehr-rheinau.de/images/how-to-become-admin-in-roblox-for-free.pdfIn PDF document text
    • http://modlingua.com/images/roblox-jailbreak-hack-keycard.pdfIn PDF document text
    • http://leigraphics.com/images/roblox-2021-cheat-engin.pdfIn PDF document text
    • http://arthakranti.org/images/how-to-hack-people-on-roblox-easy-2021.pdfIn PDF document text
    • http://www.anies.eu/images/roblox-vermillion-free-level-7-site-v3rmillionnet.pdfIn PDF document text
    • http://naturschutzgossau-zh.ch/images/how-to-make-a-roblox-ad-for-free.pdfIn PDF document text
    • http://ohsawamacrobiotics.com/images/roblox-youtubers-that-give-free-robux-out-in-their-groups.pdfIn PDF document text
    • http://ferienhaus-summt.de/images/hack-roblox-accounts-2021.pdfIn PDF document text
    • http://wireprod.net/images/buy-robux-free-en-espaol.pdfIn PDF document text
    • http://awakeningtruth.org/images/sean-cheat-roblox.pdfIn PDF document text
    • https://cintasoeste.com.ar/images/free-download-roblox-hack-tool.pdfIn PDF document text
    • http://www.makoto.su/images/how-to-hack-roblox-2021.pdfIn PDF document text
    • https://infocorrosion.com/images/how-to-download-a-swearfree-roblox-speech-pluggin.pdfIn PDF document text
    • https://pneukalousek.cz/images/how-to-hack-clothes-roblox.pdfIn PDF document text
    • https://gabrieliassociati.com/images/how-to-get-free-robux-on-amazon-fire-tablet.pdfIn PDF document text
    • http://lepatrimoinedesvallees.fr/images/roblox-hack-scripts-2021.pdfIn PDF document text
    • http://asiashop-france.fr/images/gete-free-robux.pdfIn PDF document text
    • http://lakeshistory.com/images/roblox-money-cheat-engine.pdfIn PDF document text
    • http://ottawavalleykitchens.ca/images/roblox-lumber-tycoon-hack.pdfIn PDF document text
    • http://dshikr.ru/images/roblox-bc-free-2021.pdfIn PDF document text
    • http://energyline.co/images/jailbreak-roblox-hack.pdfIn PDF document text
    • http://auto-mankel.de/images/dantdm-free-robux-code.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003dca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DCA 19504 bytes
SHA-256: 7bec66b13910bb7f7a054d4d219fcc086551fc5051a21ad61042780f59708a5f
font_01_sfnt_off00006662.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6662 18124 bytes
SHA-256: 3a681caf5a7c7497e878230bbb1a18f3041aba7be5e560ade0510658cb433394

Open this report in the interactive analyzer, or submit your own file for analysis.