Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb387358dd4dd484…

MALICIOUS

PDF

253.9 KB Created: 2021-04-05 15:28:45 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c3d4a47f71f4c1baf79d6eb58a4b9989 SHA-1: eb24ba1dc61d9859fa479660085f080ffd547eba SHA-256: eb387358dd4dd484a7ce597ab3f51efa8d555a67e35b7366c68454bb46a0e170
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and exhibits characteristics of a phishing lure, specifically a fake CAPTCHA designed to deceive users. The presence of external URIs pointing to 'roblox hack' related content suggests a social engineering attempt to trick users into downloading further malware or engaging in fraudulent activities. While no scripts were explicitly extracted, the PDF structure and embedded URIs indicate a likely attack pattern involving user interaction to initiate a download or exploit.

Machine Learning

  • Nyx PDF Classifier clean score 0.0958

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/chaosity-roblox-hack
    • http://beer-holzhaus.ch/images/how-to-add-script-on-roblox-hack.pdf
    • https://infocorrosion.com/images/roblox-hack-no-human-verification-and-no-survey.pdf
    • https://ccej.lviv.ua/images/roblox-tower-battle-hack-script.pdf
    • https://www.dachytarasowe.eu/images/free-robux-hack-pa.pdf
    • https://servotecnica.com/images/programa-para-hackear-usuuarios-de-roblox.pdf
    • http://www.das-kinderzimmer.net/images/how-to-be-headless-in-roblox-for-free.pdf
    • http://damvallei.be/images/invited-free-robux-glitch-by-unknown.pdf
    • http://wcasrock.org/images/inject-hack-robux-com.pdf
    • http://unifieo.br/images/obby-for-free-robux.pdf
    • http://ltmphoto.com/images/free-roblox-back-accessories.pdf
    • http://santeh-40.ru/images/cheat-roblox-ninja-legend.pdf
    • http://prohsa.com/images/best-free-outfit-in-roblox.pdf
    • http://www.imperialaccountingfl.com/images/how-can-i-free-robux-on-roblox-games.pdf
    • http://www.arredifunebri.com/images/free-robux-no-human-verification-2021-pc.pdf
    • http://k2visual.com.br/images/how-do-you-get-free-robux-2021.pdf
    • https://schaefer-rechtsanwaelte.com/images/free-robux-hack-2021-generator.pdf
    • http://gops.pruszczgdanski.pl/images/how-to-hack-roblox-free-robux-2021.pdf
    • http://www.peterdejonge.nl/images/how-to-use-speed-hack-on-roblox.pdf
    • http://immobil-service.it/images/how-to-get-free-robux-no-survey-no-online-generator.pdf
    • http://horsa18.ru/images/free-headset-in-roblox.pdf
    • http://linde-erbach.de/images/roblox-speed-hack-2021-cheat-engine.pdf
    • http://laboraltoledo.com/images/cool-free-robux-outfits.pdf
    • http://krymtorg-r.ru/images/meepcity-roblox-hack-menu.pdf
    • http://indotec.fr/images/free-roblox-faces-codes.pdf
    • http://nalmpantistractors.gr/images/roblox-free-roam-camera.pdf
    • https://pneukalousek.cz/images/hacks-for-roblox-no-human-vertifcation.pdf
    • http://domaizdereva24.ru/images/roblox-free-hat-pastebin.pdf
    • http://schrichte.de/images/sex-hacks-for-roblox.pdf
    • https://ai-appenzell.ch/images/free-t-shirt-adidas-in-roblox.pdf
    • http://szekelymozes.ro/images/how-do-i-get-the-free-robux.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00038789.bin
3c5105f02bfd0ce2123ae3a7e5fc71450e67ea77c519cfeaaa9fbff2ed965b35		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x38789 26344 bytes
font_01_sfnt_off0003c397.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C397 5696 bytes
font_02_sfnt_off0003d0a9.bin
cd2a6ae0e9074c71767a9b1ff5a7ed34d76731a04f9d184079ce8cfc8ccdcca9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D0A9 18032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.