Malicious PDF — malware analysis report

Static analysis result for SHA-256 f453d3919249583f…

MALICIOUS

PDF

57.9 KB Created: 2021-04-05 20:30:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-24
MD5: c1a3ccce6ce1deccd401e65e2e73be77 SHA-1: e5db205253a96ffa2951769e7ff67a95ed2c2c44 SHA-256: f453d3919249583f0f1cb79cbd88d3c49129d98d07329a7150950442ee2eb45e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF document was flagged as malicious by an ML classifier. It uses a fake browser/software-install lure. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7795

Heuristics 4

  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-roblox-stuff-2021 PDF link annotation
    • http://www.cosver.nl/images/how-to-get-stuff-on-roblox-for-free-2021.pdfIn PDF document text
    • http://cmfd.nl/images/free-robux-pc-no-human-verification.pdfIn PDF document text
    • http://sdsdar.org/images/roblox-jailbreak-money-hack-pastebin.pdfIn PDF document text
    • http://riccardodurso.it/images/www-free-robux-hacker.pdfIn PDF document text
    • https://vtvvaals.nl/images/roblox-ban-script-hack.pdfIn PDF document text
    • http://subarulegacy.com/images/how-to-do-the-sex-hack-on-roblox-2021.pdfIn PDF document text
    • http://ilifemarket.ru/images/roblox-lumber-tycoon-cheat-engine-2021.pdfIn PDF document text
    • http://www.hawler.in/images/exploit-hack-roblox-free-download-mod-menu-pc.pdfIn PDF document text
    • http://fradiomas.com/images/how-to-hack-roblox-hax.pdfIn PDF document text
    • http://ce-tsv-nantes.fr/images/roblox-hack-gui.pdfIn PDF document text
    • http://abqwinair.com/images/play-roblox-com-free.pdfIn PDF document text
    • https://www.cnte.org.br/images/hack-roblox-vip.pdfIn PDF document text
    • http://www.mostraining.co.za/images/how-to-hack-other-pples-stuff-on-roblox-mm2.pdfIn PDF document text
    • https://reggieslockandkey.com/images/free-robux-legit-no-survey.pdfIn PDF document text
    • http://echosvoix.ch/images/how-to-make-free-robux-games.pdfIn PDF document text
    • http://colegioluisamigo.cl/images/free-roblox-2021-accounts.pdfIn PDF document text
    • https://www.iadh.bi/images/free-robux-at-freerobuxeu.pdfIn PDF document text
    • http://www.brtes.com/images/roblox-cheat-codes-for-vehicle-simulator.pdfIn PDF document text
    • http://www.lrnetwork.es/images/roblox-hacks-for-pet-simulator.pdfIn PDF document text
    • http://armatrutz.de/images/roblox-mod-menu-free.pdfIn PDF document text
    • http://moto98.com/images/how-to-enable-the-free-models-searcher-in-roblox-studiuo.pdfIn PDF document text
    • http://www.isril.it/images/roblox-without-cheat-engine.pdfIn PDF document text
    • https://www.hotschool.com.au/images/roblox-hack-hack-de-robux-2021.pdfIn PDF document text
    • https://gafaseo.com/images/online-free-roblox-no-download.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/free-accounts-with-space-names-roblox.pdfIn PDF document text
    • http://ptts.pl/images/how-to-get-robux-and-builders-club-for-free.pdfIn PDF document text
    • http://ambingenieria.com/images/rich-free-roblox-accounts.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/how-to-get-free-robux-and-doing-nothing-for-it.pdfIn PDF document text
    • http://www.hotelcimone.it/images/hack-de-juegos-apk-robux-gratis.pdfIn PDF document text
    • http://cosver.eu/images/roblox-mod-free-robux.pdfIn PDF document text
    • http://ff-obertraun.at/images/floating-hack-in-roblox-star-wars-first-order.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/roblox-hoodie-t-shirt-free-shipping.pdfIn PDF document text
    • https://www.hotschool.com.au/images/free-robux-app-2021.pdfIn PDF document text
    • http://www.actae.gr/images/free-roblox-group-payouts.pdfIn PDF document text
    • http://genialica.de/images/robux-free-roblox-hack.pdfIn PDF document text
    • https://www.utalii.ac.ke/images/roblox-boost-free-robux.pdfIn PDF document text
    • http://www.awakeningtruth.org/images/roblox-torso-position-cheat-engine.pdfIn PDF document text
    • http://loszavera.com/images/how-to-get-free-vip-in-roblox.pdfIn PDF document text
    • http://harmonygardens.ca/images/dragon-ball-fury-roblox-hacked.pdfIn PDF document text
    • http://j-cook.pro/images/roblox-the-lords-of-nomrial-hack.pdfIn PDF document text
    • http://hydroconseil.com/images/free-robux-pagedemo-co.pdfIn PDF document text
    • http://wattkit.com/images/how-to-get-free-tix-on-roblox-2021.pdfIn PDF document text
    • http://zibai.eu/images/roblox-champion-free-shirt.pdfIn PDF document text
    • http://www.fanciullovito.it/images/400-robux-free.pdfIn PDF document text
    • https://www.millatgears.com/images/roblox-battle-royale-hack-script.pdfIn PDF document text
    • http://businessfit.com/images/roblox-hacks-lua-vs-lua-c.pdfIn PDF document text
    • http://palogar.es/images/how-to-hack-roblox-games-on-pc.pdfIn PDF document text
    • http://lakomat.by/images/how-to-gett-free-robux.pdfIn PDF document text
    • http://pescatun.es/images/super-nice-mml-hack-roblox.pdfIn PDF document text
    +11 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008407.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8407 26136 bytes
SHA-256: 08ae1b94c2c0d404a34aaf163cc0864aba67853476bf35d58761fb2e806e20bd
font_01_sfnt_off0000bfa1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFA1 17988 bytes
SHA-256: dc47951990d8d5a4f190a62f9b366b02cddb893207ef071aa26901dc750d9555