Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea449d45b79cf903…

MALICIOUS

PDF

251.8 KB Created: 2021-04-04 11:04:27 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 50c3e05946bbc00f35bf2932a1643d28 SHA-1: 6d4d20ab73480b86ee4b2e278b761af6f7466844 SHA-256: ea449d45b79cf9034ac72896ee2c320bdbce844db0b9e23f9e4d25bc705fe28e
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA heuristic, indicating a social engineering attempt to trick the user. The document body and extracted URLs heavily reference 'Roblox', 'Robux', and 'hacks', suggesting a phishing lure for game-related currency or cheats. The presence of multiple external URLs points to the document's role in directing users to malicious content or downloads.

Machine Learning

  • Nyx PDF Classifier clean score 0.1358

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-robux-hack-no-survey-or-download-2021 PDF link annotation
    • http://m-sv.net/images/free-easy-robux-today.pdfIn PDF document text
    • http://panaceafamilymedicine.com/images/roblox-booga-booga-coin-hack.pdfIn PDF document text
    • http://muko-unterfranken.info/images/cheats-for-the-plaza-roblox.pdfIn PDF document text
    • https://sdg-trade.com/images/roblox-injector-free-download.pdfIn PDF document text
    • http://traveltrucks.com.au/images/cheat-pour-roblox.pdfIn PDF document text
    • http://parkinsononline.com/images/cheat-indetectable-roblox-fly.pdfIn PDF document text
    • http://nevesomost.by/images/rbxfree-com-free-robux.pdfIn PDF document text
    • http://www.occquimica.com.br/images/how-to-hack-roblox-kazok.pdfIn PDF document text
    • http://museumkk.ru/images/how-to-sell-roblox-items-for-free.pdfIn PDF document text
    • http://lechia-sedziszow.pl/images/roblox-auto-piano-hack.pdfIn PDF document text
    • http://jugendfeuerwehr-scheinfeld.de/images/how-to-hack-in-mad-games-roblox.pdfIn PDF document text
    • http://finalstand.org/images/roblox-noclip-free.pdfIn PDF document text
    • http://naturschutzgossau-zh.ch/images/roblox-hacks-free-robux-no-human-verification.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/stella-roblox-hack-download.pdfIn PDF document text
    • http://seytarehco.com/images/free-roblox-executor-2021.pdfIn PDF document text
    • http://ehma.com/images/how-to-hack-games-in-roblox-on-ipad.pdfIn PDF document text
    • http://bit-sky.com/images/roblox-free-gift-card-codes-2021.pdfIn PDF document text
    • http://schrichte.de/images/using-cheat-engine-on-roblox-bloxburg.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/free-christmas-meepcity-roblox.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/wie-kann-man-roblox-hacken.pdfIn PDF document text
    • http://citycare.pt/images/hack-de-dinero-para-jailbreak-roblox.pdfIn PDF document text
    • http://www.htc.edu.au/images/roblox-meep-city-game-free-download.pdfIn PDF document text
    • http://nikabio.com/images/how-to-get-btools-and-speed-hack-in-roblox-jailbreak.pdfIn PDF document text
    • http://www.htc.edu.au/images/free-things-on-roblox.pdfIn PDF document text
    • https://www.inova-cuisine.fr/images/how-to-hack-on-roblox-on-skywars.pdfIn PDF document text
    • http://www.gravel.ru/images/free-robux-ad-videos-for-robux.pdfIn PDF document text
    • http://www.boic.nl/images/accounts-that-give-free-robux-when-you-visit-it.pdfIn PDF document text
    • https://sectorpravdy.com/images/ho2-to-get-free-robux.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/hackear-cuentas-de-roblox-gratuitas.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/roblox-hack-hackerbot.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00038f35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38F35 23332 bytes
SHA-256: 68537cac1f47152dd6f8cfec026d3e6caf81f6832910858b1219b7a81f369ccb
font_01_sfnt_off0003c386.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C386 19060 bytes
SHA-256: ba43eae05d84c620089353670d237cdbf78a6cc7d12ab1b413fd6cd5d30c479d

Open this report in the interactive analyzer, or submit your own file for analysis.