PDF malware analysis — malicious · e470ef066d9d048a

MALICIOUS

PDF

240.0 KB Created: 2021-04-05 06:30:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-16

MD5: 3efda33b02ae8860338cda2b1a62143c SHA-1: efe7dc11ce9aea13c2d916765e3599d731cc5112 SHA-256: e470ef066d9d048a18f9bf61afc2c6b2a1c9cdba71417236d81e15b477af9b17

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of external URIs. The embedded URLs and document content suggest a phishing lure related to 'Roblox' cheats, aiming to trick users into visiting malicious sites. No scripts were extracted from this sample, but the overall pattern points to a phishing campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.5773

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/tradlands-roblox-cheats-tricks PDF link annotation
- http://elllanorestaurants.com/images/get-free-robux-from-roblox.pdfIn PDF document text
- https://www.appartamenticroazia24.com/images/how-to-hack-a-roblox-account-back.pdfIn PDF document text
- http://www.copoint.co.uk/images/how-to-sell-a-clothes-roblox-free.pdfIn PDF document text
- https://www.utalii.ac.ke/images/how-to-get-free-roblox-items-2021.pdfIn PDF document text
- https://xn--80adfcepoood1a3b.xn--p1ai/images/free-codes-for-roblox-case-clicker.pdfIn PDF document text
- https://www.colditex.com/images/roblox-speed-cheat.pdfIn PDF document text
- http://gitagasht.com/images/hack-a-roblox-account-2021.pdfIn PDF document text
- http://standart-lab.ru/images/how-to-hack-audio-in-roblox.pdfIn PDF document text
- https://gabrieliassociati.com/images/unlimited-robux-hack-no-human-verification.pdfIn PDF document text
- http://dottgagliardi.com/images/how-to-get-free-robux-2021-android.pdfIn PDF document text
- http://zibai.eu/images/how-to-get-free-radio-gamepass-on-roblox.pdfIn PDF document text
- http://dmoraitis.gr/images/bloxburg-free-roblox.pdfIn PDF document text
- https://www.cpnf.ch/images/1m-on-roblox-hack.pdfIn PDF document text
- http://www.controverseinterapie.it/images/roblox-free-admin-hack-2021.pdfIn PDF document text
- http://www.exikom.com.ua/images/free-robux-easy-fast-ligit.pdfIn PDF document text
- http://ozonizarint.com/images/roblox-free-draw-script.pdfIn PDF document text
- https://pagadder.com/images/how-to-play-paid-acess-roblox-games-free.pdfIn PDF document text
- http://eleveurs-autrement.fr/images/fly-hack-in-eny-roblox-game-phone.pdfIn PDF document text
- http://karolinaherrera.com/images/roblox-tokyo-ghoul-bloody-nights-level-hack.pdfIn PDF document text
- http://iluvlocalplaces.com/images/roblox-free-pants-and-shirt.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00036a98.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x36A98	21312 bytes
SHA-256: `e06eef6291a9aaca1b4365d1da44c3586d11581e3ecdeea2c3c1cfe4fce4f374`
`font_01_sfnt_off0003993d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3993D	18472 bytes
SHA-256: `b5741972ba0e9b95c5c6de8b64ebe11354dbbcffb12ed4af9cd7f0dbfc7ad9aa`

Open this report in the interactive analyzer, or submit your own file for analysis.