PDF malware analysis — malicious · f40e3d7fe8486aa8

MALICIOUS

PDF

57.7 KB Created: 2021-04-06 06:39:56 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23

MD5: c860849aa7c9bb780915fb95fe9384e0 SHA-1: 5e814d9aa49e676da878561b2672bb6dbbd72101 SHA-256: f40e3d7fe8486aa829e4ef91dea827651e9738b8fbf5ee15de107f76ed01a37b

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by an ML classifier. It uses brand-impersonation credential phishing. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.7795

Heuristics 5

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://enigmagenerator.com/app/431946152/roblox-game-hack.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://bressanassessoria.com.br/images/roblox-hacked-download-free.pdfIn PDF document text
- https://javisintlmedia.com/images/funny-roblox-avatar-ideas-free.pdfIn PDF document text
- http://apcupschennai.com/images/roblox-gewicht-heben-simulator-3-hack.pdfIn PDF document text
- http://ferienwohnung-dorsten.com/images/roblox-how-to-make-animations-free.pdfIn PDF document text
- http://bilhetim.com.br/images/free-robux-gift-card-generator.pdfIn PDF document text
- https://arcasict.nl/images/roblox-piano-the-fat-ratmonody-hack-delay.pdfIn PDF document text
- https://scraperite.com/images/free-robux-giveiaway.pdfIn PDF document text
- http://www.eurologistiki.gr/images/speed-hack-roblox-script-pastebin.pdfIn PDF document text
- https://www.seeingindependence.org/images/hack-roblox-redeem-card.pdfIn PDF document text
- https://www.albisser.ch/images/how-do-you-get-free-robux-without-buying-apps.pdfIn PDF document text
- http://eltisstudio.sk/images/comment-hacker-roblox-jailbreak.pdfIn PDF document text
- http://stroygrad-spb.com/images/cool-roblox-skins-for-free.pdfIn PDF document text
- http://escolaarboc.cat/images/free-robux-without-survey.pdfIn PDF document text
- http://www.torvet11.dk/images/roblox-rb-world-hack.pdfIn PDF document text
- https://corbo.ru/images/roblox-nike-shirt-template-free-shipping.pdfIn PDF document text
- https://www.ncscolour.no/images/roblox-land-free-robux.pdfIn PDF document text
- http://loriginedupain.org/images/free-robux-pc-2021-not-patched.pdfIn PDF document text
- http://mostowicz.pl/images/free-robux-no-glitch.pdfIn PDF document text
- https://www.ukrtrans.biz/images/guuudd-info-roblox-online-hack.pdfIn PDF document text
- http://africadaily.co.za/images/hack-dragon-ball-final-stand-roblox.pdfIn PDF document text
- http://mostowicz.pl/images/how-to-hack-someones-acconut-on-roblox.pdfIn PDF document text
- http://pianoservice.com.ua/images/hello-neighbor-roblox-free-download.pdfIn PDF document text
- http://sexythings.gr/images/robux-for-free-2021.pdfIn PDF document text
- http://unc-europe.com/images/how-to-get-free-robux-promo-codes.pdfIn PDF document text
- https://www.fhccu.com/images/free-robux-server.pdfIn PDF document text
- http://medimacs.eu/images/free-robux-android-app.pdfIn PDF document text
- http://www.notaioricci.it/images/free-roblox-card-hack.pdfIn PDF document text
- https://www.ncscolour.no/images/free-roblox-pickaxes.pdfIn PDF document text
- http://eleveurs-autrement.fr/images/best-games-to-hack-on-roblox.pdfIn PDF document text
- https://wandpiraten.de/images/roblox-mad-paintball-hack.pdfIn PDF document text
- http://elllanorestaurants.com/images/top-10-mejores-hacks-para-roblox.pdfIn PDF document text
- https://www.lavigny.ch/images/free-powerful-gun-on-nuclear-plant-tycoon-roblox.pdfIn PDF document text
- http://www.inservis.cl/images/free-robux-generator-and-v-bucks.pdfIn PDF document text
- https://www.ghknights.org/images/roblox-free-car-games.pdfIn PDF document text
- https://sectorpravdy.com/images/free-simulator-script-roblox.pdfIn PDF document text
- http://ltdirect.co.uk/images/roblox-arsenal-hacks-free.pdfIn PDF document text
- http://www.controverseinterapie.it/images/does-e-free-work-roblox.pdfIn PDF document text
- http://chartsmart.com.au/images/roblox-free-exploit-download.pdfIn PDF document text
- http://modlingua.com/images/one-piece-final-chapter-youtube-roblox-hack.pdfIn PDF document text
- http://energotestcontrol.ru/images/robux-hack-no-download-2021.pdfIn PDF document text
- https://www.plumbermedics.com/images/how-to-look-cool-on-roblox-free.pdfIn PDF document text
- https://gafaseo.com/images/how-to-hack-on-ipad-roblox.pdfIn PDF document text
- http://pdia.de/images/roblox-hack-tool-2021-download.pdfIn PDF document text
- https://waterpark.by:443/images/roblox-anti-cheat-video.pdfIn PDF document text
- http://standart-lab.ru/images/best-way-to-get-robux-for-free.pdfIn PDF document text
- https://sitam.co.in/images/2-free-tacos-roblox.pdfIn PDF document text
- https://beejekorf.nl/images/roblox-currency-hack-lua-script.pdfIn PDF document text
- https://gigbagwinkel.nl/images/roblox-free-robux-mod.pdfIn PDF document text
- http://legs11.co.za/images/btools-hack-roblox-jailbreak.pdfIn PDF document text
+11 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00007dd2.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x7DD2	29076 bytes
SHA-256: `0683e122ed3b37b8dd27b2ff18c42d3328c3a91770031bd0c845096f39d571b2`
`font_01_sfnt_off0000bed6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBED6	18012 bytes
SHA-256: `d206121f168dc4e035b35ac1682d70bed3f8101e6cfcfaab370b99c1eefdef43`

Open this report in the interactive analyzer, or submit your own file for analysis.