Malicious PDF — malware analysis report

Static analysis result for SHA-256 e61d836d2ba5893e…

MALICIOUS

PDF

56.5 KB Created: 2021-04-06 02:26:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: f0dcda7d0cd2205b08d61fa48295f7b5 SHA-1: fb46b324e1912d61e3cc90a65fbf5ea8ffd78184 SHA-256: e61d836d2ba5893e821883f753dac7da8e3f3a1101663949943815e741f9240a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is a PDF document that impersonates Microsoft and uses urgency lures to trick the user into clicking a link. The primary link, http://gaminggenerator.org/app/431946152/roblox-free-games-folder, is associated with downloading a file. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 5

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/roblox-free-games-folder.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-free-games-folder PDF link annotation
    • https://www.ausecus.com/images/steal-anyones-robux-hack.pdfIn PDF document text
    • http://wokbaarlo.nl/images/script-cheat-roblox.pdfIn PDF document text
    • https://www.hotschool.com.au/images/roblox-hack-apk-for-pc.pdfIn PDF document text
    • http://getthelook-bkk.com/images/how-to-get-explorer-up-on-roblox-hack.pdfIn PDF document text
    • https://treeconsult.de/images/free-roblox-followers-2021.pdfIn PDF document text
    • http://echosvoix.ch/images/how-do-you-get-free-robux-while-playing-roblox.pdfIn PDF document text
    • http://goosesscuba.com/images/roblox-free-flying-practice-place.pdfIn PDF document text
    • http://www.art-concept.gr/images/nxb-how-to-get-jushin-mode-for-free-roblox.pdfIn PDF document text
    • https://sdg-trade.com/images/games-that-will-give-u-free-robux.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/how-to-become-a-roblox-hacker-robux.pdfIn PDF document text
    • http://krymtorg-r.ru/images/hacking-a-roblox-scammer.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/play-store-roblox-free.pdfIn PDF document text
    • http://fred.com.ua/images/earn-free-robux-website.pdfIn PDF document text
    • https://www.albisser.ch/images/boku-no-roblox-hack-script-buy.pdfIn PDF document text
    • https://www.brainpads.com/images/hi2-to-earn-free-robux-today.pdfIn PDF document text
    • http://hemmet-strand.dk/images/best-hacker-noob-roblox-avatar.pdfIn PDF document text
    • https://www.foodsafety.cz/images/how-to-get-free-money-in-roblox-jailbreak-2021.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/new-hack-work-100-roblox-deathrun-2021.pdfIn PDF document text
    • http://batutynas.lt/images/cheat-engine-roblox-infinite-health.pdfIn PDF document text
    • https://cdu-lengerich.de/images/how-to-hack-grand-blox-auto-roblox.pdfIn PDF document text
    • http://autenticohostalsalou.com/images/roblox-hack-app-android.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/get-free-admin-commands-roblox.pdfIn PDF document text
    • http://3dmedicus.ru/images/free-lobby-roblox.pdfIn PDF document text
    • http://www.boic.nl/images/how-to-get-free-faces-on-roblox-mac.pdfIn PDF document text
    • http://kita-sunshine.de/images/how-to-get-free-robux-easy-no-human-verification.pdfIn PDF document text
    • http://agrao.in/images/haw-to-get-free-stuff-roblox-march-2021.pdfIn PDF document text
    • http://www.isovca.com/images/roblox-superhero-package-free.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/roblox-free-items-for-avatar.pdfIn PDF document text
    • http://sdsdar.org/images/roblox-taxi-simulator-give-all-cars-hack.pdfIn PDF document text
    • https://gafaseo.com/images/bexgg-free-robux.pdfIn PDF document text
    • http://iricamidelcuore.it/images/giving-away-free-robux.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/roblox-email-for-hacked-account.pdfIn PDF document text
    • https://enpav.it/images/descargar-hack-de-robux-para-roblox-2021.pdfIn PDF document text
    • http://karolinaherrera.com/images/earn-free-robux-2021-february-2021.pdfIn PDF document text
    • http://artindex.pro/images/how-to-make-good-roblox-thumbnails-for-youtube-free.pdfIn PDF document text
    • http://pdia.de/images/roblox-how-to-get-free-items-in-catalog-2021.pdfIn PDF document text
    • http://homequeen.de/images/free-robux-generator-no-verification-pc.pdfIn PDF document text
    • http://jwcrownlimo.net/images/roblox-robux-hack-2021-october.pdfIn PDF document text
    • http://legs11.co.za/images/how-to-hack-roblox-with-lucky-patcher-no-root.pdfIn PDF document text
    • http://kfz-ilg.com/images/boku-no-legacy-roblox-free-spins.pdfIn PDF document text
    • https://corbo.ru/images/robux-free-ilimited.pdfIn PDF document text
    • http://learningarabic.co.uk/images/does-roblox-have-anti-cheat.pdfIn PDF document text
    • https://www.bmta.co.uk/images/roblox-hack-ohne-menschliche-verzierungen.pdfIn PDF document text
    • http://fotoclub3b.it/images/roblox-bots-on-free-robux-games.pdfIn PDF document text
    • http://jijel.info/images/free-robux-ohne-handynummer-deutsch.pdfIn PDF document text
    • https://www.stkdb.cz/images/using-cheat-engine-in-roblox.pdfIn PDF document text
    • http://sscclc.edu.ec/images/youtube-roblox-how-to-get-a-volt-blike-for-free.pdfIn PDF document text
    • http://stroygrad-spb.com/images/how-to-hack-in-roblox-fe2.pdfIn PDF document text
    • https://rieber-transporte.de/images/free-roblox-accounts-2021-not-banned.pdfIn PDF document text
    +20 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008128.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8128 24984 bytes
SHA-256: a51379facc4969fbb6876c21a65fa4ccc074966ad582a61028700403d6b5c4d6
font_01_sfnt_off0000ba33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA33 18036 bytes
SHA-256: 0a8b019e4af45cd02766133cc23e3a20918493d1c217282c2fe2c9c6a27cfe3e

Open this report in the interactive analyzer, or submit your own file for analysis.