PDF malware analysis — malicious · ed211f4daa479e94

MALICIOUS

PDF

240.1 KB Created: 2021-04-04 22:12:18 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23

MD5: c26b5f8fc5e54dd08bb33d767f328dc6 SHA-1: fc09a5f1fb9e6d0c467c41f46ba6c0d8d8210500 SHA-256: ed211f4daa479e94b7c13cb9390e7db23f32a00b13c742ee7a16420e62b7b7ec

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.5773

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/hack-para-tener-dinero-infinito-en-roblox PDF link annotation
- http://schlossschaenke-andernach.de/images/how-to-cheat-roblox-lumber-tycoon-2-money.pdfIn PDF document text
- http://ctr74.net/images/redboy-roblox-cheat.pdfIn PDF document text
- http://fotoflas.gr/images/free-redeem-codes-for-roblox-2021.pdfIn PDF document text
- http://techmobil.pl/images/20210-robux-for-free.pdfIn PDF document text
- https://gryps.de/images/roblox-shower-simulator-cheats-for-time.pdfIn PDF document text
- http://www.pcclawyers.com.au/images/secret-free-robux.pdfIn PDF document text
- http://belagrogen.by/images/roblox-robux-hack-2021-download.pdfIn PDF document text
- https://zabota-kashira.ru/images/beast-mode-face-roblox-free.pdfIn PDF document text
- http://www.flotom.at/images/roblox-hack-no-human-verification-2021-android.pdfIn PDF document text
- http://ns1.radiofacil.net/images/roblox-hacks-through-walls-on-jailbreak.pdfIn PDF document text
- http://kancelaria-legnica.eu/images/how-do-u-trade-someone-for-free-on-roblox-2021.pdfIn PDF document text
- http://iluvlocalplaces.com/images/roblox-doungnquest-legandary-hack.pdfIn PDF document text
- http://petarda.hu/images/roblox-noclip-cheat-engine-2021.pdfIn PDF document text
- http://www.eptaviation.com/images/hack-dragon-ball-z-roblox.pdfIn PDF document text
- http://www.marambio.com.ar/images/free-roblox-buliders-club.pdfIn PDF document text
- http://genialica.de/images/how-to-hack-people-on-roblox-2021.pdfIn PDF document text
- http://www.jureclomas.com.ar/images/dragon-ball-z-online-cheats-roblox.pdfIn PDF document text
- http://jaeger-bauplanung.de/images/how-to-hack-roblox-with-hackbar.pdfIn PDF document text
- http://evp-sanorlenok.ru/images/how-to-get-400-robux-on-roblox-for-free-2021.pdfIn PDF document text
- http://tegeler-segler.de/images/i-got-my-account-hacked-on-roblox.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00036a43.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x36A43	21656 bytes
SHA-256: `1a96e4f200519ba33e0a11ad6470f35257158d6aaccdf3c5d657d049634d6add`
`font_01_sfnt_off000399a4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x399A4	18424 bytes
SHA-256: `73772552b8ccd1865f6089a194adaaa6b0aa2ef583f7d5c78683d0201f35ac21`

Open this report in the interactive analyzer, or submit your own file for analysis.