PDF malware analysis — malicious · e7e2f7948d2984e6

MALICIOUS

PDF

53.2 KB Created: 2021-04-06 14:22:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29

MD5: 58a923e84d53fefe0f56375480e7486d SHA-1: 3e77f44ff6bcb20253a512a4875651f5dbb99bf9 SHA-256: e7e2f7948d2984e6061fb7b70ae432058f46ac6ade224949f1df4a05682030a6

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1071.001 Web Protocols

This PDF document employs a common lure of 'free Robux' and game hacks to entice users. It impersonates brands like Facebook, directing users to malicious URLs such as 'https://enigmagenerator.com/app/431946152/roblox-game-hack'. The ML classifier strongly indicated maliciousness, and the presence of numerous embedded URLs suggests a phishing or credential harvesting attempt, likely leading to further exploitation.

Machine Learning

Nyx PDF Classifier malicious score 0.8721

Heuristics 5

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://enigmagenerator.com/app/431946152/roblox-game-hack.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://www.compusiteinc.com/images/kick-players-roblox-hack.pdfIn PDF document text
- http://halitbayramoglu.com.tr/images/how-to-hack-your-level-in-boku-no-roblox.pdfIn PDF document text
- http://www.copoint.co.uk/images/roblox-retail-tycoon-hack.pdfIn PDF document text
- http://greasley.online/images/roblox-console-free-ronux-hacks.pdfIn PDF document text
- http://stroygrad-spb.com/images/how-to-hack-yourself-robux-in-roblox.pdfIn PDF document text
- http://martincoste.com/images/roblox-hack-2021-free-robux.pdfIn PDF document text
- http://grabmyinfo.com/images/roblox-hack-no-download-gui.pdfIn PDF document text
- http://paro.net.ua/images/how-to-get-free-robux-no-3-easy-steps.pdfIn PDF document text
- http://principessalialaofegypt.com/images/roblox-boga-boga-god-armor-and-god-rock-hack.pdfIn PDF document text
- https://esl.ipb.ac.id/images/working-greasyfork-robux-hack.pdfIn PDF document text
- http://fwv-vallendar.de/images/how-to-make-your-roblox-account-hackerproof.pdfIn PDF document text
- https://reggieslockandkey.com/images/roblox-steves-one-piece-stat-hack.pdfIn PDF document text
- http://evro-okna.net/images/roblox-cheat-robux-deutsch.pdfIn PDF document text
- http://jobsy.com.sg/images/how-to-change-your-roblox-name-for-free-2021.pdfIn PDF document text
- http://eooe.gr/images/free-robux-2021-fevruaryu.pdfIn PDF document text
- https://www.albisser.ch/images/roblox-highschool-money-hack-cheat-engine.pdfIn PDF document text
- http://kaleasm.org/images/https-pastebincom-incrible-hack-de-robux.pdfIn PDF document text
- https://pa-waingapu.go.id/images/free-roblox-songs-music.pdfIn PDF document text
- http://solidkom.ch/images/sparereborn-roblox-hacks.pdfIn PDF document text
- http://www.guidaturisticaverona.it/images/how-to-get-free-robux-no-verification-or-survey-2021.pdfIn PDF document text
- https://jdlgroup.ca/images/free-bc-roblox-accounts-2021.pdfIn PDF document text
- http://safeandsecurelocksmith.ca/images/how-to-get-free-robux-no-verification-2021.pdfIn PDF document text
- http://escolaarboc.cat/images/free-redeem-roblox-cards-2021.pdfIn PDF document text
- http://www.teapotjewelry.com/images/free-obc-and-robux-pastebin.pdfIn PDF document text
- https://blagvist.com.ua/images/how-to-hack-any-account-on-roblox-2021.pdfIn PDF document text
- https://heritagebanquethall.ca/images/magitan-hack-keeps-crashing-roblox.pdfIn PDF document text
- http://famoirs.co.uk/images/roblox-for-free.pdfIn PDF document text
- http://panaceafamilymedicine.com/images/can-people-hack-your-acount-on-roblox-if-you-talk.pdfIn PDF document text
- https://www.foodsafety.cz/images/roblox-play-as-geust-for-free.pdfIn PDF document text
- http://www.mediaxin.net/images/roblox-does-cheat-engine-still-work-on-roblox.pdfIn PDF document text
- http://maestriadental.com/images/free-robuxrblx-file.pdfIn PDF document text
- http://adenmarks.se/images/what-is-robloxhackexe.pdfIn PDF document text
- http://precitool.ch/images/free-robux-june.pdfIn PDF document text
- http://ansacare.com/images/roblox-blue-shirt-free.pdfIn PDF document text
- https://www.ukrtrans.biz/images/guuudd-info-roblox-online-hack.pdfIn PDF document text
- https://www.polyfin.de/images/free-roblox-gift-card-code-generator-no-survey.pdfIn PDF document text
- https://bgescc.com/images/how-models-hack-your-game-in-roblox.pdfIn PDF document text
- https://www.fhccu.com/images/the-wild-west-roblox-free.pdfIn PDF document text
- http://salantiskis.lt/images/robloxs-got-talent-piano-hack.pdfIn PDF document text
- http://axia-verlag.at/images/free-roblox-game-card-codes.pdfIn PDF document text
- http://ilijakom.com/images/easy-roblox-hack-2021.pdfIn PDF document text
- http://sfera-express.ru/images/free-cam-script-roblox-v3rmillion.pdfIn PDF document text
- http://heddalboring.no/images/hacks-de-roblox-prueba.pdfIn PDF document text
- http://medicalafrica.net/images/roblox-offline-free-download-pc.pdfIn PDF document text
- http://sb2m.com.br/images/roblox-cheat-codes.pdfIn PDF document text
- http://medimacs.eu/images/free-hacks-inspect-roblox.pdfIn PDF document text
- http://linde-erbach.de/images/roblox-free-expoit-that-run-loadstring.pdfIn PDF document text
- http://panaceafamilymedicine.com/images/noclip-hacks-roblox-download.pdfIn PDF document text
- https://www.fhccu.com/images/download-tool-for-free-robux.pdfIn PDF document text
+13 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006e20.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6E20	26284 bytes
SHA-256: `7669b6596081daec174dbe0c71f5e0d0bae178ce358cca859766c4a17d6b1e4d`
`font_01_sfnt_off0000abbb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xABBB	18308 bytes
SHA-256: `63d44d011aae5a089fee633fa1e77cb133cef2e7c3660ba50c5f19c21ca0e173`

Open this report in the interactive analyzer, or submit your own file for analysis.