Malicious PDF — malware analysis report

Static analysis result for SHA-256 eac538d052f659eb…

MALICIOUS

PDF

56.6 KB Created: 2021-04-05 22:27:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-14
MD5: a682a4dbbe2c9f63e99d1396507ecea8 SHA-1: db5631d5f10817158482d82e130fb4efd53b09b7 SHA-256: eac538d052f659ebd2ba76aa34e931079252747fbf870d67ce585b5f17385de6
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs, identified by the PDF_GAME_HACK_SEO_LINK_FARM heuristic, that lead to websites promising game hacks and free currency. These URLs are presented as lures, likely to trick users into visiting malicious sites. While no scripts were explicitly extracted, the nature of the content suggests a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 6

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/granny-roblox-free-money PDF link annotation
    • http://sb2m.com.br/images/hack-aimbot-roblox-gartis.pdfIn PDF document text
    • http://bunadsmaria.com/images/2021-hacks-for-robloxs-aimbot.pdfIn PDF document text
    • http://kancelaria-legnica.eu/images/roblox-free-admin-commands.pdfIn PDF document text
    • https://meltonschool.org/images/free-roblox-hackingcom.pdfIn PDF document text
    • http://biccairo.com/images/game-freak-free-robux.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/roblox-mania-get-free-robux.pdfIn PDF document text
    • http://soma.com.ua/images/how-to-wins-free-robux.pdfIn PDF document text
    • http://brandyourbody.com/images/google-how-do-we-get-free-robux.pdfIn PDF document text
    • http://www.controverseinterapie.it/images/jojo-free-robux.pdfIn PDF document text
    • https://studentcareerinfo.com/images/how-2-hack-roblox-for-robux.pdfIn PDF document text
    • http://www.cosver.nl/images/how-to-get-free-robux-with-crome.pdfIn PDF document text
    • https://www.porthos.it/images/roblox-games-for-free-no-download.pdfIn PDF document text
    • http://www.duchidicastelluccio.it/images/get-free-robux-the-real-way.pdfIn PDF document text
    • http://ff-klaffenbach.de/images/roblox-tuto-hack.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/how-to-get-free-robux-by-watching-a-video.pdfIn PDF document text
    • https://amatq.ca/images/free-robux-may-2021.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/free-roblox-followers-generator-2021.pdfIn PDF document text
    • http://riccardodurso.it/images/free-robux-verified-by-roblox.pdfIn PDF document text
    • http://mydevice.com.au/images/how-to-get-free-clothes-on-roblox-easy.pdfIn PDF document text
    • http://eltisstudio.sk/images/free-robux-codes-no-verification-2021.pdfIn PDF document text
    • https://pompesfunebresleveque.fr/images/free-robux-and-tix-app.pdfIn PDF document text
    • https://www.saisystem.it/images/robux-free-2021-sans-verification-humaine.pdfIn PDF document text
    • http://eurocomes.com/images/roblox-teleport-cheat.pdfIn PDF document text
    • http://kontaktadig.se/images/howto-get-free-robux-hack-javascript.pdfIn PDF document text
    • https://infocorrosion.com/images/how-to-hack-and-know-everyones-pass-in-roblox.pdfIn PDF document text
    • http://osteonad.com/images/copying-roblox-games-for-free-v3rmillion.pdfIn PDF document text
    • https://www.fhccu.com/images/robux-hack-download.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/free-hack-roblox-download.pdfIn PDF document text
    • https://jdlgroup.ca/images/how-to-change-your-face-on-roblox-for-free.pdfIn PDF document text
    • http://ecoleduchat-grenoble.fr/images/free-2021-roblox-codes.pdfIn PDF document text
    • http://nebraskahospitalityhalloffame.com/images/roblox-fe-btools-script-hack.pdfIn PDF document text
    • http://lv-siegen.de/images/roblox-how-to-get-free-vip-in-fashon-frenzy.pdfIn PDF document text
    • https://gryps.de/images/wheel-decide-free-robux.pdfIn PDF document text
    • https://www.kambati.co.za/images/how-to-redeem-a-roblox-card-for-free.pdfIn PDF document text
    • http://www.occquimica.com.br/images/roblox-hack-unlimited-robux-and-tickets.pdfIn PDF document text
    • https://ambarevleri.com/images/roblox-ben-10-free-download.pdfIn PDF document text
    • http://bressanassessoria.com.br/images/roblox-apk-hack-uptodown.pdfIn PDF document text
    • http://linens.kiev.ua/images/hack-jailbreak-roblox-2021-krankheit.pdfIn PDF document text
    • http://ekaterinakorneva.com/images/roblox-twisted-murderer-free-credits-givaway.pdfIn PDF document text
    • http://immo360grad.com/images/free-unlimited-robux-hack-is-legal.pdfIn PDF document text
    • http://bibliotheque-perrigny-les-dijon.fr/images/how-to-hack-roblox-accounts-2021-new-method.pdfIn PDF document text
    • http://www.teapotjewelry.com/images/free-godzilla-stuff-roblox.pdfIn PDF document text
    • http://energotestcontrol.ru/images/roblox-secret-free-items.pdfIn PDF document text
    • http://jkcoaching.nl/images/hack-for-roblox-cbro.pdfIn PDF document text
    • http://getthelook-bkk.com/images/how-to-fly-hack-in-roblox-phantom-forces-2021.pdfIn PDF document text
    • https://www.sauvonsleclimat.org/images/hack-apk-download-roblox.pdfIn PDF document text
    • http://fotoclub3b.it/images/roblox-free-download-online.pdfIn PDF document text
    • https://www.ferienhausdirektkroatien.de/images/free-roblox-hoods.pdfIn PDF document text
    • https://newenglandafs.com/images/v3rmillion-roblox-hack.pdfIn PDF document text
    +14 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000813d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x813D 24884 bytes
SHA-256: a11a85e3e10afa5480ef7402c4301f856b4b87e6f692ee3f156eea748b75aa62
font_01_sfnt_off0000badc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBADC 17948 bytes
SHA-256: 100e465421f52e661e653163942ecde0395bf242c96b429e3fccf60b31685d14