PDF malware analysis — malicious · e7207d6453bb356b

MALICIOUS

PDF

59.0 KB Created: 2021-04-05 22:30:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 99c5ba04427bb040abbd793b377f13e0 SHA-1: 60da58fdf8cefad446129fb421b5d065a2c6e549 SHA-256: e7207d6453bb356bf978b5173fc0a08f7d82d12fa939d36fb6a0c5c206e3a590

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by an ML classifier. It uses a LOLBin command-execution lure. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.6397

Heuristics 4

LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/http-roblox-hack PDF link annotation
- http://safeandsecurelocksmith.ca/images/best-roblox-free-hacks-exploits.pdfIn PDF document text
- https://inscastellar.cat/images/hack-para-mad-city-roblox-2021.pdfIn PDF document text
- https://wandersuechtig.de/images/hack-roblox-cb-ro.pdfIn PDF document text
- http://alarmed.pl/images/hacked-by-roblox-transpernt-backround.pdfIn PDF document text
- https://gryps.de/images/roblox-card-codes-free-2021.pdfIn PDF document text
- http://fsgtoday.com/images/123-free-robux-is-this-a-hack.pdfIn PDF document text
- http://evro-okna.net/images/hack-executor-for-roblox.pdfIn PDF document text
- https://www.albisser.ch/images/infinite-jump-wearedevs-roblox-hack.pdfIn PDF document text
- http://escolaarboc.cat/images/free-roblox-to-play-without-downloading.pdfIn PDF document text
- http://energotestcontrol.ru/images/proxy-roblox-hack-download.pdfIn PDF document text
- http://www.lovecraftiana.com.ar/images/how-to-get-free-tokens-in-car-crushers-2-roblox.pdfIn PDF document text
- https://www.milewood.co.uk/images/do-u-get-free-robux-in-roblox.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/roblox-gift-card-codes-free-2021.pdfIn PDF document text
- https://www.beaufortcollege.ie/images/roblox-windows-10-edition-unpatched-cheat-engine.pdfIn PDF document text
- http://piadaandco.it/images/roblox-prison-life-cheat-engine-hack.pdfIn PDF document text
- http://gamixpaliwa.pl/images/free-cod-style-games-roblox.pdfIn PDF document text
- http://zibai.eu/images/free-gfx-roblox-2021.pdfIn PDF document text
- http://bb-im2.com/images/roblox-synapse-free.pdfIn PDF document text
- http://fa-deco.com/images/roblox-prizes-free-robux.pdfIn PDF document text
- http://www.mjclautrec.fr/images/roblox-elemental-battlegrounds-hack-script.pdfIn PDF document text
- http://pdapanache.com/images/hacks-for-roblox-bee-swarm-simulator.pdfIn PDF document text
- http://abqwinair.com/images/asshurtv2-roblox-hack.pdfIn PDF document text
- https://www.tsdb.com.au/images/free-stuff-on-roblox-2021.pdfIn PDF document text
- http://pacatuamigo.com/images/best-game-to-hack-in-roblox.pdfIn PDF document text
- http://sandra-masemann.de/images/roblox-free-white-hair.pdfIn PDF document text
- http://uctovnictvosnv.sk/images/roblox-free-shirt-not-model.pdfIn PDF document text
- http://interokna-kuban.ru/images/roblox-freebies-com-hack.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/free-shirt-promo-code-for-roblox.pdfIn PDF document text
- http://www.brtes.com/images/how-to-get-free-robux-on-iphone-6s.pdfIn PDF document text
- http://piadaandco.it/images/roblox-free-draw-2-anime.pdfIn PDF document text
- http://ns1.radiofacil.net/images/roblox-online-free-no-download.pdfIn PDF document text
- http://acktivities.com/images/barren-cheats-roblox.pdfIn PDF document text
- https://www.osoc.com/images/free-roblox-generator-2021-no-human-verification.pdfIn PDF document text
- http://cdescolapios.org/images/speed-script-roblox-hack-pastebin.pdfIn PDF document text
- http://cmfd.nl/images/roblox-phantom-forces-hack-client.pdfIn PDF document text
- http://www.lascalamilanowallcovering.it/images/synapse-roblox-free-2021.pdfIn PDF document text
- https://meltonschool.org/images/can-you-use-cheat-engine-with-roblox.pdfIn PDF document text
- http://wcasrock.org/images/ninja-animation-package-free-roblox.pdfIn PDF document text
- http://bilhetim.com.br/images/how-to-get-free-robux-on-roblox-xbox-one-2021.pdfIn PDF document text
- http://zarinnameh.ir/images/roblox-its-not-free.pdfIn PDF document text
- https://technospektr.com.ua/images/roblox-hack-tool-download-2021-pc.pdfIn PDF document text
- http://cmme.it/images/roblox-player-radar-script-hack.pdfIn PDF document text
- http://diatecgroup.com/images/800-free-robux-gamekit.pdfIn PDF document text
- http://algierimasonry.com/images/exploit-hack-roblox-synpase-free-download.pdfIn PDF document text
- http://www.controverseinterapie.it/images/free-shirt-maker-roblox.pdfIn PDF document text
- https://billiekawende.com/images/comment-avoir-des-pices-dans-roblox-avec-cheat-engine.pdfIn PDF document text
- http://www.occquimica.com.br/images/how-to-get-free-bc-in-roblox-pastebin.pdfIn PDF document text
- https://piscinasmundoacuatico.com/images/free-roblox-gea.pdfIn PDF document text
- http://hardbit.cn/images/roblox-kohl-admin-house-hack-2021.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008158.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8158	25324 bytes
SHA-256: `2ddce2229edecacb7d03679e1f88df0dfcbe0bc282ecf3ce383dd95c833866d3`
`font_01_sfnt_off0000bb3f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBB3F	2848 bytes
SHA-256: `4737c2778a085e0cb49e73f3b054b1a71e3f40720d213b4bfda97f95a31bfbf1`
`font_02_sfnt_off0000c500.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC500	17552 bytes
SHA-256: `dcd92bb484a5dca2aed41ee1cb28dfba5589aaf04a694a6fdb038f81ed3a0273`

Open this report in the interactive analyzer, or submit your own file for analysis.