Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1957895bb23a7bc…

MALICIOUS

PDF

45.8 KB Created: 2021-04-03 08:29:45 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 29bf143458141f6a37b967cd9f1cd37d SHA-1: db7b3afd5942773b64ccae97c0288c9abdfabe9c SHA-256: f1957895bb23a7bc664c45bb1a5c97eab1438956a83df831210be3061d15190b
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs that lead to a link farm, primarily focused on 'game hacks' and 'free Robux' scams. The heuristic firings confirm this is a link farm designed to lure users to potentially malicious sites. While no scripts were extracted, the document's structure and content strongly suggest it's a phishing or scam document, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9434

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-custom-script-runner-roblox PDF link annotation
    • http://gops.pruszczgdanski.pl/images/free-promo-codes-for-roblox-robux.pdfIn PDF document text
    • http://bilhetim.com.br/images/hacks-para-tener-robux-2021.pdfIn PDF document text
    • http://hemmet-strand.dk/images/what-is-free-roblox-generator.pdfIn PDF document text
    • https://technospektr.com.ua/images/roblox-bee-swarm-simulator-free-diamond-egg.pdfIn PDF document text
    • http://agrao.in/images/how-to-hack-robux-with-cheat-engine-64.pdfIn PDF document text
    • https://www.u-pin-it.com/images/how-to-get-free-robux-on-your-computer.pdfIn PDF document text
    • http://zarinnameh.ir/images/roblox-free-robux-no-fike.pdfIn PDF document text
    • https://www.udivadlahotel.cz/images/free-4-now-info-roblox.pdfIn PDF document text
    • http://zarinnameh.ir/images/are-robux-hack-legit-forums.pdfIn PDF document text
    • http://www.evaplast.by/images/how-to-hack-into-admin-on-roblox.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/free-robux-andoid-robux-hac.pdfIn PDF document text
    • http://www.exikom.com.ua/images/free-robux-without-human-verification-and-survey-2021.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/le-jeux-du-hack-roblox.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/how-to-get-free-schrt-in-robux-copyng-it.pdfIn PDF document text
    • https://www.hotschool.com.au/images/i-need-free-robux-now.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/free-robux-no-survey-no-human-verification-2021.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/best-free-exploit-roblox-bing.pdfIn PDF document text
    • http://www.gadanie.lv/images/trolling-outfits-roblox-free.pdfIn PDF document text
    • https://www.ncscolour.no/images/how-to-hack-a-roblox-server-and-save-it.pdfIn PDF document text
    • http://www.evaplast.by/images/download-phantom-forces-roblox-aimbot-hack-script-2021-tutorial.pdfIn PDF document text
    • http://www.marambio.com.ar/images/how-to-get-free-robux-hack-no-download.pdfIn PDF document text
    • https://www.millatgears.com/images/roblox-police-car-free.pdfIn PDF document text
    • https://www.foodsafety.cz/images/how-to-upgrade-to-roblox-builders-club-free.pdfIn PDF document text
    • http://www.marambio.com.ar/images/akatzuki-roblox-t-shirt-free.pdfIn PDF document text
    • http://www.anies.eu/images/roblox-virus-free-exploits.pdfIn PDF document text
    • https://pa-waingapu.go.id/images/how-to-get-free-stuff-on-roblox-hack.pdfIn PDF document text
    • http://www.remiauclair.fr/images/no-hack-robux.pdfIn PDF document text
    • http://www.vktzunami.cz/images/hot-to-get-free-robux-2021-may.pdfIn PDF document text
    • http://www.remiauclair.fr/images/hack-roblox-autokill.pdfIn PDF document text
    • https://www.milewood.co.uk/images/roblox-free-robux-hack.pdfIn PDF document text
    • https://bancroftandsons.com/images/https-www-roblox-cheat.pdfIn PDF document text
    • https://www.audev.com/images/how-to-get-free-robux-legit-2021.pdfIn PDF document text
    • https://www.sinaloadiario.mx/images/the-underground-war-roblox-cheats.pdfIn PDF document text
    • https://www.sinaloadiario.mx/images/hack-dragon-ball-rage-roblox-mobil.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/prooving-that-how-to-get-free-cloths-e-free-roblox.pdfIn PDF document text
    • https://bancroftandsons.com/images/cheat-engine-robux-hack.pdfIn PDF document text
    • https://verdensbarn.no/images/how-get-free-robux-no-scam-no-survey.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/can-you-hack-roblox-by-puttin-hack-the-players-name.pdfIn PDF document text
    • https://verdensbarn.no/images/deadzone-roblox-hack.pdfIn PDF document text
    • https://www.dierenartsberghman.be/images/roblox-exploit-hack-full-lua-overpowered-commands.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/how-to-get-pants-for-free-on-roblox-without-bc.pdfIn PDF document text
    • http://legs11.co.za/images/free-roblox-bear-mask.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/get-free-robux-points.pdfIn PDF document text
    • http://nevesomost.by/images/roblox-lvl-7-script-executor-free-mac.pdfIn PDF document text
    • https://pemadamapi.net/images/hack-de-roblox-para-alas-gratis.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/can-my-roblox-account-got-hacked.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/roblox-boy-hair-free.pdfIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/free-roblox-codes-that-nobody-have-havent-used-yet.pdfIn PDF document text
    • https://www.milewood.co.uk/images/how-to-get-roblox-admin-for-free.pdfIn PDF document text
    +2 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000058e7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x58E7 23416 bytes
SHA-256: 60e896ef1ea524871a1e4cf202f4a854fb9a929921d16cf410e5231d00ec80cf
font_01_sfnt_off00008dec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8DEC 18476 bytes
SHA-256: fe72198fe87acfc240b3b6f5bed008550bbc045acd9b67965c9c0826bdc72421

Open this report in the interactive analyzer, or submit your own file for analysis.