Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecb168b4efb19210…

MALICIOUS

PDF

243.5 KB Created: 2021-04-04 11:15:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 08f85aeba256214f929b28d291668c29 SHA-1: 11f04953fe065d9e28c532a3e7dfdceed2a8d45c SHA-256: ecb168b4efb19210e8e27a99a9bbec71cdefc9c5c917645abfa938fbd1251fb0
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as a phishing lure by heuristics, containing a single image and a clickable link disguised as a download button. The embedded URL points to a site offering 'Roblox Hack Coden', suggesting a scam or phishing attempt targeting Roblox users. Although no scripts were explicitly extracted, the PDF structure and URL indicate a malicious intent to redirect users to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier clean score 0.1227

Heuristics 5

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 243 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-hack-coden PDF link annotation
    • https://www.millatgears.com/images/how-do-u-get-free-robux-on-chromebook.pdfIn PDF document text
    • https://www.brainpads.com/images/how-to-hack-robux-java-script-pastebin.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/roblox-destruction-simulator-hack-2021.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/cicada-wings-roblox-free.pdfIn PDF document text
    • http://aviaprofsoyuz.info/images/how-to-hack-coins-in-assassin-roblox.pdfIn PDF document text
    • http://wireprod.net/images/carte-roblox-free-card.pdfIn PDF document text
    • https://zabota-kashira.ru/images/robux-hack-working-2021.pdfIn PDF document text
    • https://www.stkdb.cz/images/cheat-roblox-2021-btools.pdfIn PDF document text
    • http://www.teapotjewelry.com/images/november-hack-for-robux.pdfIn PDF document text
    • http://www.inservis.cl/images/wheel-decide-free-roblox.pdfIn PDF document text
    • http://butkimloai.com/images/how-to-change-your-roblox-username-for-free-2021.pdfIn PDF document text
    • https://www.alu-as.cz/images/speed-hack-in-any-roblox-game-2021-not-in-jailbreak.pdfIn PDF document text
    • https://seedungo.com/images/roblox-crc7-hack-admin.pdfIn PDF document text
    • http://lanoblaie.fr/images/roblox-hack-strucid.pdfIn PDF document text
    • http://smart-pro.co.uk/images/roblox-robux-hack-no-download-2021.pdfIn PDF document text
    • http://schrichte.de/images/comment-installer-un-cheat-sur-roblox-bulble-gum.pdfIn PDF document text
    • http://fiur-malermeister.de/images/how-to-hack-robux-no-generator.pdfIn PDF document text
    • https://yarburservices.ru/images/free-limiteds-on-roblox.pdfIn PDF document text
    • http://laboraltoledo.com/images/robux-for-free-no-survey-2021.pdfIn PDF document text
    • http://stitchingart.com/images/free-games-at-roblox-com-htm.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/how-to-hack-protect-jojo-roblox.pdfIn PDF document text
    • http://loszavera.com/images/roblox-hack-set-robux-2021.pdfIn PDF document text
    • http://sb2m.com.br/images/hack-that-can-get-you-into-peoples-games-in-roblox.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/bleach-roblox-hack.pdfIn PDF document text
    • http://bilhetim.com.br/images/how-to-hack-into-any-roblox-account-2021.pdfIn PDF document text
    • http://domaizdereva24.ru/images/free-jackets-in-roblox.pdfIn PDF document text
    • https://www.dachytarasowe.eu/images/free-roblox-hair-boy-rainbow.pdfIn PDF document text
    • http://imp.lg.ua/images/mad-fucker-roblox-hack.pdfIn PDF document text
    • http://www.hawler.in/images/free-boho-salon-roblox-application.pdfIn PDF document text
    • http://daksz.hu/images/how-can-i-free-robux-on-roblox-games.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00037f21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37F21 18940 bytes
SHA-256: f0e33fbb9c0dcfb2384c1444ba23580b0781035974695d98f4ec86b56ce88a0e
font_01_sfnt_off0003a6a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A6A9 17732 bytes
SHA-256: 62ddd73f4bf81166f120fa1664ee15868f66b23d3bb56bb5cfbaa7aedff02d0d

Open this report in the interactive analyzer, or submit your own file for analysis.