PDF malware analysis — malicious · ee3cb0abdf7063e3

MALICIOUS

PDF

57.6 KB Created: 2021-04-06 06:20:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29

MD5: c2fe8a5b5fdf0948abf6fdeab7766178 SHA-1: 9e754a69b58e5af3475d26e8c63b0f8a5be51481 SHA-256: ee3cb0abdf7063e3fe43739385eb2289de056f9652a0add8fe8b8240e4784b69

130 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains lures for game hacks and free Robux, impersonating Microsoft to trick users into clicking a malicious link. The primary link, http://enigmagenerator.com/app/431946152/roblox-game-hack, is identified as a credential phishing attempt. While no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it may exploit vulnerabilities or redirect to malicious content, aligning with common PDF-based attack vectors.

Machine Learning

Nyx PDF Classifier malicious score 0.7795

Heuristics 6

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://enigmagenerator.com/app/431946152/roblox-game-hack.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- https://www.gymun.cz/images/roblox-how-to-get-non-free-models.pdfIn PDF document text
- http://martincoste.com/images/comment-gagner-des-robux-sans-hack.pdfIn PDF document text
- http://unionmusicaldebenidorm.com/images/roblox-hack-download-pc-no-virus.pdfIn PDF document text
- https://verdensbarn.no/images/free-limited-items-roblox.pdfIn PDF document text
- http://zarinnameh.ir/images/how-to-report-being-hack-on-roblox.pdfIn PDF document text
- http://www.boic.nl/images/hacks-for-mad-paintball-on-roblox.pdfIn PDF document text
- http://eventgo.fr/images/how-are-people-hacking-roblox-jailbreak-2021.pdfIn PDF document text
- https://jdlgroup.ca/images/dragon-ball-z-final-stand-free-roblox-hack.pdfIn PDF document text
- http://artindex.pro/images/all-free-offsale-items-on-roblox-wika.pdfIn PDF document text
- http://global-tech-security.be/images/hack-snow-shoveling-simulator-roblox.pdfIn PDF document text
- http://ktn.com.br/images/free-builders-club-roblox-script.pdfIn PDF document text
- http://iluvlocalplaces.com/images/free-gfx-roblox-2021.pdfIn PDF document text
- http://gaec.cl/images/free-robux-hack-generator-2021-that-i-can-download.pdfIn PDF document text
- http://badboybiteaway.de/images/how-to-get-items-for-free-in-roblox-2021.pdfIn PDF document text
- http://tdfsinfronteras.com/images/free-robux-generator-xyz.pdfIn PDF document text
- https://www.sitiwebjoomla.it/images/pastebin-com-roblox-free-robux.pdfIn PDF document text
- http://www.copoint.co.uk/images/how-to-get-1m-free-robux-everyday.pdfIn PDF document text
- http://news123.it/images/roblox-dinosaur-simulator-cheat-engine-dna.pdfIn PDF document text
- http://energotestcontrol.ru/images/downlaod-fly-cheat-roblox.pdfIn PDF document text
- http://grand-ural74.ru/images/free-roblox-cards-no-scam.pdfIn PDF document text
- http://axia-verlag.at/images/code-pin-free-roblox.pdfIn PDF document text
- http://paro.net.ua/images/how-to-get-free-robux-by-inspecting-element.pdfIn PDF document text
- http://stackideas.com/images/apk-hack-roblox-2021.pdfIn PDF document text
- https://www.lavigny.ch/images/buy-robux-for-free-2021.pdfIn PDF document text
- http://agrupamentoescolas-alfredo-da-silva.com/images/robux-for-free-real.pdfIn PDF document text
- http://mostowicz.pl/images/roblox-4all-hack.pdfIn PDF document text
- http://www.rezbb.sk/images/roblox-virus-free-exploits.pdfIn PDF document text
- http://kids-academy.pl/images/free-robux-no-wait-to-generator-no-survey.pdfIn PDF document text
- http://www.les2alpes-location.com/images/project-alpha-roblox-cheats.pdfIn PDF document text
- http://nouveaupavillon.fr/images/hack-para-romper-paredes-en-roblox.pdfIn PDF document text
- http://prohsa.com/images/free-roblox-accounts-with-robux-list.pdfIn PDF document text
- https://www.romedia.gr/images/how-to-get-free-gamepass-on-roblox-pastebin.pdfIn PDF document text
- http://lechia-sedziszow.pl/images/free-card-codes-roblox-2021-no-survey-no-download.pdfIn PDF document text
- http://www.gongoff.com/images/beyblade-roblox-beta-damage-hack.pdfIn PDF document text
- https://sitam.co.in/images/how-to-be-a-jailbreak-hacker-roblox.pdfIn PDF document text
- http://ns1.radiofacil.net/images/roblox-hack-scripts-download-no-virus.pdfIn PDF document text
- http://museumkk.ru/images/free-oakley-roblox.pdfIn PDF document text
- http://www.campiresine.it/images/free-gears-on-roblox.pdfIn PDF document text
- https://luminouswisdom.org/images/free-exploit-roblox-auto-updating.pdfIn PDF document text
- http://nevesomost.by/images/characters-roblox-free.pdfIn PDF document text
- http://nosocomium.rv.ua/images/free-robux-code-generator-online.pdfIn PDF document text
- http://alarmed.pl/images/change-your-roblox-username-for-free.pdfIn PDF document text
- http://www.liceoantoniotoledo.com/images/grand-theft-auto-roblox-cheats.pdfIn PDF document text
- http://altc.de/images/play-roblox-online-for-free-no-download.pdfIn PDF document text
- http://salantiskis.lt/images/roblox-island-life-paradise-hack.pdfIn PDF document text
- http://arhi-z.ru/images/roblox-hack-2021-download.pdfIn PDF document text
- https://www.manisoft.ir/images/how-to-get-free-items-from-games-roblox-2021.pdfIn PDF document text
- http://hydroconseil.net/images/roblox-admin-panel-robux-hack.pdfIn PDF document text
- http://firstaidacademy.be/images/echter-hacker-in-roblox.pdfIn PDF document text
+11 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000081aa.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x81AA	26428 bytes
SHA-256: `de3b961802f5ffa7908631d5bc12b24082c5c25920b1a4e42bd40306131fb3cb`
`font_01_sfnt_off0000be2a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBE2A	18192 bytes
SHA-256: `cb574f6e15d9faa345ca8c655456d1b4fa344a1d1c06c37738842d4dfcf4b038`

Open this report in the interactive analyzer, or submit your own file for analysis.