PDF malware analysis — malicious · ee37578233f6b65d

MALICIOUS

PDF

53.2 KB Created: 2021-04-06 13:19:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 47fabd328cb2d73d58b9170cb3d59c3a SHA-1: 1407a462f6ffefa70d22bd3485f88798000efe0e SHA-256: ee37578233f6b65d1a353c560e8d38eb71ea6a97391d2196f886ef6a28059b1a

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by an ML classifier. It uses a fake browser/software-install lure. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.8721

Heuristics 5

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://clinicadentalvilaplana.es/images/roblox-hub-free-fiv-server.pdfIn PDF document text
- https://seedungo.com/images/roblox-brocken-bones-4-ban-cheat.pdfIn PDF document text
- http://mostowicz.pl/images/roblox-script-executor-free-download.pdfIn PDF document text
- https://eleganceautospa.ca/images/roblox-jailbreak-2021-hack.pdfIn PDF document text
- http://bilhetim.com.br/images/free-roblox-promo-codes-2021-august.pdfIn PDF document text
- https://www.tartineartisanal.com/images/roblox-blotch-shikai-hack-script.pdfIn PDF document text
- http://gamixpaliwa.pl/images/roblox-how-to-look-like-a-ghost-for-free.pdfIn PDF document text
- http://www.compusiteinc.com/images/how-to-noclip-hack-in-roblox-2021.pdfIn PDF document text
- http://www.remiauclair.fr/images/roblox-lego-hacking-script.pdfIn PDF document text
- http://www.agri-tech.com.au/images/robux-hack-online-free.pdfIn PDF document text
- https://www.eglihotel.gr/images/robux-hack-today.pdfIn PDF document text
- https://www.air-shop.cz/images/i-hacked-it-roblox-piano.pdfIn PDF document text
- http://cmme.it/images/roblox-hacks-phantom-forces-2021-regedit.pdfIn PDF document text
- http://homequeen.de/images/roblox-hacking-scripts-2021.pdfIn PDF document text
- https://www.udivadlahotel.cz/images/hacker-commands-roblox.pdfIn PDF document text
- https://esl.ipb.ac.id/images/roblox-bc-hack-download.pdfIn PDF document text
- http://eastwestmacrobiotics.com/images/free-unused-robux-codes.pdfIn PDF document text
- http://ferienwohnung-walker.de/images/fame-simulator-roblox-hack.pdfIn PDF document text
- http://kontaktadig.se/images/roblox-how-to-get-free-clothes-ios.pdfIn PDF document text
- http://sandra-masemann.de/images/free-robux-codes-on-tablet-2021.pdfIn PDF document text
- http://pourvosvacances.com/images/roblox-free-robux-hack-no-human-verification-2021.pdfIn PDF document text
- http://vibrato.fr/images/how-to-get-free-robux-with-a-fake-card.pdfIn PDF document text
- http://aviaprofsoyuz.info/images/red-boy-how-to-get-free-robux.pdfIn PDF document text
- https://www.vacationrentalsincroatia.com/images/free-robux-pastebin-no-wait.pdfIn PDF document text
- https://www.brainpads.com/images/husky-roblox-obby-free-robux.pdfIn PDF document text
- https://www.ncscolour.no/images/roblox-play-as-guest-for-free.pdfIn PDF document text
- http://caraless.com/images/military-simulator-roblox-hacks.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/roblox-walk-through-walls-hack-no-cheat-engine.pdfIn PDF document text
- http://selectionspdf.fr/images/hacking-in-parkour-in-roblox.pdfIn PDF document text
- http://ines.co.rs/images/nuke-hack-for-roblox.pdfIn PDF document text
- http://svp-steinmaur.ch/images/free-robux-1-minute.pdfIn PDF document text
- http://harmonygardens.ca/images/roblox-level-100-hack.pdfIn PDF document text
- http://apostolosandreaslemesou.com/images/how-to-get-free-shark-teeth-in-sharkbite-roblox.pdfIn PDF document text
- http://ofertaromania.net/images/how-to-get-free-robux-2021-no-survey-no-download.pdfIn PDF document text
- http://mnp-realty.ru/images/groups-in-roblox-that-give-free-robux.pdfIn PDF document text
- http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/roblox-wanted-hack-pastebin.pdfIn PDF document text
- https://scraperite.com/images/how-to-cheat-in-roblox.pdfIn PDF document text
- https://europainstitut.hu/images/hack-all-computers-roblox.pdfIn PDF document text
- http://uctovnictvosnv.sk/images/how-to-get-free-robux-without-downloading-apps-on-ipad.pdfIn PDF document text
- https://vtvvaals.nl/images/comment-hacker-un-compte-roblox-2021-fr.pdfIn PDF document text
- http://www.flotom.at/images/free-roblox-pc-download.pdfIn PDF document text
- https://consorziocsa-asicaivano.it/images/cool-roblox-avatar-free.pdfIn PDF document text
- http://iedarelief.us/images/superhros-roblox-free.pdfIn PDF document text
- http://www.pleiadisrl.it/images/roblox-2021-free-robux-give-away.pdfIn PDF document text
- https://pa-waingapu.go.id/images/roblox-free-bundles-2021.pdfIn PDF document text
- http://www.tamogatoweb.hu/images/how-to-get-clothes-free-on-roblox.pdfIn PDF document text
- http://aistplus.ru/images/roblox-free-catalog-items-blogspot-com.pdfIn PDF document text
- http://alroglobal.com/images/how-to-get-free-robux-on-roblox-hack.pdfIn PDF document text
- http://www.nielsen2u.dk/images/catalog-roblox-free-items.pdfIn PDF document text
+13 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006c07.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6C07	27652 bytes
SHA-256: `406d8b054ae1012e680cb54efd3857ab243b6235a7c1e5ea6ae2034c61522f3e`
`font_01_sfnt_off0000aa6c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAA6C	18932 bytes
SHA-256: `34908379061b685a9afc43f92fea1abf50bffd48d69cea58b63cc06a7c1240fc`

Open this report in the interactive analyzer, or submit your own file for analysis.