PDF static analysis report

Static analysis result for SHA-256 ed0eb7da454116d6…

SUSPICIOUS

PDF

46.0 KB Created: 2021-04-03 03:46:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 10c5589103c08fa8522d1e620e9ac847 SHA-1: 9e4ebfcde3bb92c56ecedc43a25fe35d7dad4f67 SHA-256: ed0eb7da454116d6abd229bded09edfc13ab7044f6edc5fcc67baed81fa7fb9b
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links related to Roblox game exploits and hacks, including a prominent link to 'gaminggenerator.org'. The ML classifier flagged this PDF as malicious with a high score. The presence of embedded URLs and the document's theme suggest a phishing or scam attempt to redirect users to potentially malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9414

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-admin-commands-roblox-id PDF link annotation
    • https://www.seeingindependence.org/images/hacking-roblox-items.pdfIn PDF document text
    • http://cosver.eu/images/roblox-ninja-legends-hack-script.pdfIn PDF document text
    • http://www.eurosan1.ba/images/globux-me-free-robux.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/roblox-avatar-customize-free.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/get-free-robux-without.pdfIn PDF document text
    • https://www.eglihotel.gr/images/officialrobuxhack-updated.pdfIn PDF document text
    • https://komakinosite.jp/images/free-robux-generator-no-human-verification-for-pc.pdfIn PDF document text
    • http://www.hawler.in/images/roblox-fallen-hack.pdfIn PDF document text
    • http://www.ntc.edu.za/images/uirbxclub-free-robux-hacker-p.pdfIn PDF document text
    • https://verdensbarn.no/images/roblox-epic-minigames-hack-2021.pdfIn PDF document text
    • https://www.hbproducts.dk/images/roblox-island-royale-cheat.pdfIn PDF document text
    • http://hemmet-strand.dk/images/free-roblox-account-over-30-days.pdfIn PDF document text
    • http://pa-tanjungselor.go.id/images/free-face-on-roblox-2021.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/cerberus-hack-program-roblox.pdfIn PDF document text
    • http://poltekkeskhjogja.ac.id/images/free-robux-hack-on-laptop-july-2021.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/hack-denisdaily-roblox-account.pdfIn PDF document text
    • http://sscclc.edu.ec/images/roblox-free-branch-crown.pdfIn PDF document text
    • https://www.seeingindependence.org/images/www-free-robux-codes-info.pdfIn PDF document text
    • https://www.saisystem.it/images/how-to-hack-into-roblox-acc.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/how-to-get-a-free-radio-in-roblox.pdfIn PDF document text
    • http://www.visiblefilm.com/images/how-does-a-roblox-account-get-hacked.pdfIn PDF document text
    • https://www.tsdb.com.au/images/flippy-hacking-people-roblox.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/roblox-fortnite-simulator-hack.pdfIn PDF document text
    • http://www.lovecraftiana.com.ar/images/cheats-for-roblox-murder-mystery-2.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/free-jailbreak-coins-roblox.pdfIn PDF document text
    • https://www.hbproducts.dk/images/how-to-get-free-diamonds-on-royale-high-roblox-hack.pdfIn PDF document text
    • https://gomsa.nl/images/robux-earn-free.pdfIn PDF document text
    • https://komakinosite.jp/images/get-free-eggmin-egg-on-roblox-egg-hunt-2021-livw.pdfIn PDF document text
    • http://www.actae.gr/images/free-robux-grab-points.pdfIn PDF document text
    • http://www.cuniv-naama.dz/images/roblox-robux-hack-pc.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/roblox-master-hand-hack.pdfIn PDF document text
    • http://www.mikramarine.gr/images/free-roblox-3d-loading-screen.pdfIn PDF document text
    • http://www.drent.se/images/bloxawards-hack-robux.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/how-to-make-a-hacker-in-roblox.pdfIn PDF document text
    • http://www.jureclomas.com.ar/images/how-to-get-free-robux-on-roblox-on-ipad-2021.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/how-to-record-on-roblox-on-pc-for-free.pdfIn PDF document text
    • https://www.brainpads.com/images/how-to-get-free-jailbreak-money-roblox.pdfIn PDF document text
    • http://www.rezbb.sk/images/hack-admin-sword-roblox.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/hack-roblox-jailbreak-noclip-2021.pdfIn PDF document text
    • http://www.rezbb.sk/images/shadowslayefighter-in-roblox-robux-hack.pdfIn PDF document text
    • http://www.vktzunami.cz/images/free-robux-new-logo-roblox.pdfIn PDF document text
    • http://www.marambio.com.ar/images/roblox-free-accounts-pastebin.pdfIn PDF document text
    • https://estalagemmonteverde.com.br/images/roblox-cheat-engine-for-mac.pdfIn PDF document text
    • http://www.copoint.co.uk/images/how-to-get-free-robux-fast-and-easy-2021.pdfIn PDF document text
    • http://uptodate.az/images/roblox-parkour-hack-2021.pdfIn PDF document text
    • http://echosvoix.ch/images/green-scarfs-roblox-for-free.pdfIn PDF document text
    • https://verdensbarn.no/images/los-hacker-mas-famosos-de-roblox.pdfIn PDF document text
    • http://www.cosver.nl/images/admin-hacks-for-roblox-2021.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/roblox-pokemon-brick-bronze-hack.pdfIn PDF document text
    +2 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000058fa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x58FA 23960 bytes
SHA-256: 3d9780387d841fb50f3407875bc7bf9c6b9b8b6cd008b6202729bcac8f9ca13e
font_01_sfnt_off00008f4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8F4D 18316 bytes
SHA-256: dd37cff48690598d9b4cad46c7d890ea501da7c08debbcdb0ac31aadfcabff53