Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0e0b303d1f83100…

MALICIOUS

PDF

59.4 KB Created: 2021-04-06 00:48:17 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 677d2c6302127edd76e345c88386a9c7 SHA-1: f18da3158add64b94ea69a9ac71e3471ba5cce7f SHA-256: e0e0b303d1f831004ea8d9f070f895c1a75365f64cd10a10756833f5945c2c74
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF document was flagged as malicious by an ML classifier. It uses a fake browser/software-install lure. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6397

Heuristics 4

  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/dantdm-com-free-account-roblox PDF link annotation
    • http://baah.ca/images/free-outrageous-builders-club-roblox.pdfIn PDF document text
    • https://www.u-pin-it.com/images/free-followers-roblox-2021.pdfIn PDF document text
    • http://gaec.cl/images/shop-roblox-free.pdfIn PDF document text
    • http://businessmart.ro/images/are-there-any-actual-robux-cheats.pdfIn PDF document text
    • https://luminouswisdom.org/images/free-roblox-account-with-robux-on-it.pdfIn PDF document text
    • http://moralcenter.or.th/images/how-to-hack-roblox-prison-life.pdfIn PDF document text
    • https://liftkos.com/images/free-unused-roblox-card-codes-2021.pdfIn PDF document text
    • http://pourvosvacances.com/images/free-robux-websites-that-scam-you.pdfIn PDF document text
    • http://sb2m.com.br/images/roblox-hack-scripts-for-children.pdfIn PDF document text
    • http://harmonygardens.ca/images/how-to-open-a-hack-in-roblox.pdfIn PDF document text
    • http://bilhetim.com.br/images/a-game-that-someone-cant-hack-in-roblox.pdfIn PDF document text
    • http://aadvanderklaauw.nl/images/roblox-ios-cheats.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/how-to-hack-and-on-roblox-on-murderer-mystery-2.pdfIn PDF document text
    • https://eleganceautospa.ca/images/roblox-bear-cheats.pdfIn PDF document text
    • https://newenglandafs.com/images/roblox-robux-hack-no-download-2021.pdfIn PDF document text
    • http://teknotools.net/images/roblox-hack-game.pdfIn PDF document text
    • http://pia2000.net/images/free-roblox-accounts-with-robux-2021-august.pdfIn PDF document text
    • http://www.hawler.in/images/free-robux-generator-with-no-offers.pdfIn PDF document text
    • https://laconce.com/images/how-to-get-25-robux-for-free.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/got-to-get-free-robux.pdfIn PDF document text
    • http://hindicenter.com/images/free-roblox-hacks-net.pdfIn PDF document text
    • http://www.bestyears.co.uk/images/cool-accessories-in-roblox-for-free.pdfIn PDF document text
    • https://kimolos-link.gr/images/free-tuxedo-pants-in-roblox.pdfIn PDF document text
    • http://internetdeputy.com/images/how-to-hack-in-roblox-hoops.pdfIn PDF document text
    • http://www.inservis.cl/images/como-usar-cheat-engine-en-roblox.pdfIn PDF document text
    • http://ff-obertraun.at/images/how-to-get-free-robux-no-robot-proof.pdfIn PDF document text
    • https://ai-appenzell.ch/images/easy-free-100-legit-mouse-courser-roblox-givaway.pdfIn PDF document text
    • http://ff-obertraun.at/images/if-you-join-this-game-you-get-hacked-roblox.pdfIn PDF document text
    • http://www.evaplast.by/images/free-equipment-roblox.pdfIn PDF document text
    • http://agrao.in/images/roblox-cheats-how-to-get-free-clothes.pdfIn PDF document text
    • http://www.aldopesetti.com/images/free-robux-no-verification-2021-ios.pdfIn PDF document text
    • http://parsbaft.com/images/what-happens-if-your-hacking-in-roblox.pdfIn PDF document text
    • https://semanasantacehegin.com/images/how-to-hack-some-one-with-cookies-roblox.pdfIn PDF document text
    • https://bapalaye.org/images/how-to-hack-on-vehicle-sim-roblox.pdfIn PDF document text
    • https://www.hbproducts.dk/images/can-i-get-a-hacked-roblox-account-back-without-email.pdfIn PDF document text
    • http://glll.de/images/hack-de-robux-2021-android-fast.pdfIn PDF document text
    • http://legs11.co.za/images/how-to-hack-roblox-booga-booga-for-mac.pdfIn PDF document text
    • http://ff-klaffenbach.de/images/cowboy-tshirt-roblox-free.pdfIn PDF document text
    • http://sscclc.edu.ec/images/how-to-get-your-old-hacked-roblox-account-back.pdfIn PDF document text
    • http://armatrutz.de/images/free-roblox-shirts-girl.pdfIn PDF document text
    • http://apostolosandreaslemesou.com/images/how-to-get-free-robux-inspect-element-2021.pdfIn PDF document text
    • http://mydevice.com.au/images/hacks-para-roblox-hospital-roleplay-30.pdfIn PDF document text
    • http://santjoandelesabadesses.cat/images/bhop-hack-roblox.pdfIn PDF document text
    • http://sb2m.com.br/images/how-to-check-if-hacker-fired-code-roblox.pdfIn PDF document text
    • https://www.mrsz.ir/images/comment-hacker-un-jouer-roblox.pdfIn PDF document text
    • https://www.wadowice24.pl/images/xex-roblox-cheat.pdfIn PDF document text
    • http://tecnodue.com/images/hack-para-jailbreak-roblox-2021-dinero-infinito.pdfIn PDF document text
    • https://luminouswisdom.org/images/roblox-strucid-free-private-server-join.pdfIn PDF document text
    • http://jdlwealth.com/images/can-you-get-robux-with-cheat-engine.pdfIn PDF document text
    +17 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000811c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x811C 25836 bytes
SHA-256: 43a01cc94212fc273dc46175f44c5a45e6c655fd600c8e399437e52d3fd295b1
font_01_sfnt_off0000b9ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9CE 2844 bytes
SHA-256: baad2f3f6808f4af03fa9398e38c580c8d846f7f773a947d8cc1f39b2753d31a
font_02_sfnt_off0000c390.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC390 18556 bytes
SHA-256: 895653bb1f250236f04278da1bf4b21098d521e10a507140ab6423424a21285d

Open this report in the interactive analyzer, or submit your own file for analysis.