Malicious PDF — malware analysis report

Static analysis result for SHA-256 f234a92dcdb3eac0…

MALICIOUS

PDF

58.9 KB Created: 2021-04-06 22:42:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 42eb5746b3f063e6b35a43a0cf2ddace SHA-1: 11ac4e4b68992ee02ffbb0e10bbeb53f5c55a6c5 SHA-256: f234a92dcdb3eac0c2bb83ff7e997a871a2593b4e2b52ae15fd8281e65a2a9ba
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • https://socialvalue.gr/images/free-code-roblox-2021.pdfIn PDF document text
    • http://lv-siegen.de/images/free-robux-in-5-steps.pdfIn PDF document text
    • http://cosver.eu/images/how-to-hack-roblox-to-get-robux-2021.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/free-robux-inspect-pastebin.pdfIn PDF document text
    • http://glll.de/images/roblox-script-adopt-and-raise-a-cute-baby-free-admin.pdfIn PDF document text
    • http://caraless.com/images/free-animation-roblox.pdfIn PDF document text
    • http://demenagementlandry.com/images/hack-pack-roblox-level-7.pdfIn PDF document text
    • http://bkd1.balikpapan.go.id/images/hack-para-la-annimasion-de-ninja-en-roblox.pdfIn PDF document text
    • https://estalagemmonteverde.com.br/images/free-robux-generator-november-2021-no-human-verification.pdfIn PDF document text
    • http://legs11.co.za/images/roblox-cs-ro-hack.pdfIn PDF document text
    • https://www.saisystem.it/images/yin-and-yang-roblox-hack.pdfIn PDF document text
    • http://ago.gov.pg/images/robux-hack-pc-2021.pdfIn PDF document text
    • http://kruiz21.ru/images/how-to-get-free-superhero-package-on-roblox.pdfIn PDF document text
    • http://ff-klaffenbach.de/images/how-to-make-a-dominus-in-roblox-for-free.pdfIn PDF document text
    • http://www.vktzunami.cz/images/ccv3-cheats-for-roblox.pdfIn PDF document text
    • http://vipservice-bg.com/images/how-to-get-free-robux-on-ipad-mini-4.pdfIn PDF document text
    • https://www.milewood.co.uk/images/how-to-get-free-robux-and-save-it.pdfIn PDF document text
    • http://smoothjazzclub.net/images/free-robux-generator-for-10-year-olds.pdfIn PDF document text
    • http://optsuvenir.by/images/bee-swarm-simulator-gifted-cheat-roblox.pdfIn PDF document text
    • https://www.inova-cuisine.fr/images/scaciati-mega-cheat-roblox-2021.pdfIn PDF document text
    • https://letturatarghe.it/images/free-codes-for-robux-2021.pdfIn PDF document text
    • http://hk-kan.org/images/free-robux-no-downloading-apps-2021.pdfIn PDF document text
    • http://energotestcontrol.ru/images/free-codes-for-robux-2021.pdfIn PDF document text
    • http://www.herricht.at/images/how-to-hack-roblox-on-ipad-2021.pdfIn PDF document text
    • http://www.copoint.co.uk/images/free-robux-on-robux-store.pdfIn PDF document text
    • https://billiekawende.com/images/roblox-jailbreak-money-hack-check-cashed.pdfIn PDF document text
    • http://webstan.be/images/hox-to-get-free-item-in-roblox.pdfIn PDF document text
    • http://mainzer-marktplatz.de/images/free-robux-tech.pdfIn PDF document text
    • http://dos.most.gov.la/images/free-robux-credit-card-number.pdfIn PDF document text
    • http://meisterhaus-guterl.de/images/roblox-moon-miners-hack.pdfIn PDF document text
    • http://iluvlocalplaces.com/images/hack-people-on-roblox.pdfIn PDF document text
    • http://www.marambio.com.ar/images/roblox-hack-scripts-2021-powerplay.pdfIn PDF document text
    • https://www.arquetopia.org/images/how-to-make-a-free-shirt-on-roblox.pdfIn PDF document text
    • http://www.drent.se/images/free-roblox-gift-cards-not-used.pdfIn PDF document text
    • https://verdensbarn.no/images/roblox-robloxian-high-school-tix-hack.pdfIn PDF document text
    • http://goosesscuba.com/images/how-to-hack-roblox-ban-accounts.pdfIn PDF document text
    • https://abouttimetech.com/images/roblox-hack-pw-2021.pdfIn PDF document text
    • http://loriginedupain.org/images/roblox-how-to-get-free-gamepasses-2021.pdfIn PDF document text
    • http://www.likto.eu/images/how-to-cheat-on-roblox-with-cheat-engine.pdfIn PDF document text
    • http://paro.net.ua/images/how-to-get-free-robux-by-inspecting-element.pdfIn PDF document text
    • http://www.isovca.com/images/free-random-roblox-accounts.pdfIn PDF document text
    • http://swibome.nl/images/what-happens-if-u-hack-roblox.pdfIn PDF document text
    • http://pa-tanjungselor.go.id/images/roblox-catalog-hack-script-pastebin-2021.pdfIn PDF document text
    • http://axia-verlag.at/images/roblox-free-boy-clothes.pdfIn PDF document text
    • https://wandpiraten.de/images/free-robux-roblox-wwwgeneratoronlineinfo-roblox.pdfIn PDF document text
    • http://baofrance.com/images/how-to-get-promo-codes-robux-free-202100.pdfIn PDF document text
    • http://www.anies.eu/images/free-robux-no-human-verification-no-download-2021.pdfIn PDF document text
    • http://belagrogen.by/images/mobilehacks4u-free-robux.pdfIn PDF document text
    • http://smallcom.fr/images/free-rs999-999-999-on-roblox.pdfIn PDF document text
    +15 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000704c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x704C 38400 bytes
SHA-256: 98e31a7ccb7c74e58db808075257a246e1c80e991165e98750fa6e65cc34ae0a
font_01_sfnt_off0000c2a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2A9 18428 bytes
SHA-256: a77d572570c220b75aae30bec0de8c8851222404260d101e72491a9f2f75a161

Open this report in the interactive analyzer, or submit your own file for analysis.