PDF malware analysis — malicious · f45462054c8511e5

MALICIOUS

PDF

55.2 KB Created: 2021-04-07 02:12:52 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 70a871f172b7db4007e475432ff13353 SHA-1: 4b3e31bc24a2afa47cc3e4b4e1aac3ed41714f42 SHA-256: f45462054c8511e58b929d88fccbf6c239620941c6d5bbeab252ed6543e77085

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.6397

Heuristics 4

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://www.brtes.com/images/hack-promo-codes-roblox.pdfIn PDF document text
- http://www.exikom.com.ua/images/hack-keeps-crashing-roblox.pdfIn PDF document text
- http://www.liceoantoniotoledo.com/images/have-free-robux.pdfIn PDF document text
- http://darruzzo.com/images/change-roblox-username-for-free.pdfIn PDF document text
- http://www.pbconsulting.it/images/hack-legends-of-speed-roblox.pdfIn PDF document text
- https://www.audipec.com.br/images/hack-exploit-for-roblox-no-virus.pdfIn PDF document text
- http://moto98.com/images/free-rs-in-roblox-2021.pdfIn PDF document text
- http://alexandrion.com/images/roblox-how-to-get-free-robux-website.pdfIn PDF document text
- https://gigbagwinkel.nl/images/www-roblox-games-free-com.pdfIn PDF document text
- http://the-specials.ch/images/rexex-free-robux.pdfIn PDF document text
- https://billiekawende.com/images/roblox-hack-counter-blox-roblox-offensive.pdfIn PDF document text
- http://www.htc.edu.au/images/el-mejore-hack-de-roblox-marzo.pdfIn PDF document text
- http://livebybuddhism.org/images/como-hackear-roblox-android.pdfIn PDF document text
- http://www.vktzunami.cz/images/como-tener-mas-dinero-en-adopt-me-roblox-con-hacks.pdfIn PDF document text
- http://act.gr/images/robux-hack-2021-creado-por-hackdejuegosapk-roblox-tm.pdfIn PDF document text
- https://estalagemmonteverde.com.br/images/how-to-get-a-tool-in-fe-yield-roblox-hack.pdfIn PDF document text
- https://bdsm-centrum.com/images/funcionando-nuevo-hack-roblox-jailbreak-phantom-forces-booga-booga.pdfIn PDF document text
- https://pneukalousek.cz/images/roblox-unlimited-health-hack.pdfIn PDF document text
- http://genialica.com/images/cool-free-roblox-outfit-2021.pdfIn PDF document text
- http://gops.pruszczgdanski.pl/images/hack-scripting-in-roblox.pdfIn PDF document text
- http://mainzer-marktplatz.de/images/best-roblox-exploits-2021-free.pdfIn PDF document text
- http://uniman.ch/images/comment-se-faire-hacker-dans-roblox.pdfIn PDF document text
- http://energotestcontrol.ru/images/free-robux-no-verivaction.pdfIn PDF document text
- http://naturschutzgossau-zh.ch/images/how-to-get-free-robux-on-mac-2021.pdfIn PDF document text
- http://citycare.pt/images/pastebin-hack-de-roblox.pdfIn PDF document text
- http://martincoste.com/images/hban-hacks-in-roblox.pdfIn PDF document text
- http://xn--apartementos-smfora-cala-ratjada-4vc.de/images/roblox-catalog-heaven-free-banned-weapons.pdfIn PDF document text
- https://www.osoc.com/images/synapse-x-hack-roblox.pdfIn PDF document text
- https://sanjoseelectricians.net/images/roblox-groups-that-give-you-free-robux.pdfIn PDF document text
- http://fishtech.is/images/roblox-hacker-song.pdfIn PDF document text
- http://fotoflas.gr/images/free-redeem-robux-cards.pdfIn PDF document text
- https://www.accessoriperdisabili.com/images/how-to-get-into-steal-hack-someones-roblox-account.pdfIn PDF document text
- https://scraperite.com/images/female-hacker-roblox.pdfIn PDF document text
- https://technospektr.com.ua/images/rbxraincom-free-robux.pdfIn PDF document text
- http://www.drent.se/images/roblox-hack-get-unlimited-robux-2021.pdfIn PDF document text
- https://masseymotorcars.com/images/how-to-use-brutus-to-hack-roblox.pdfIn PDF document text
- http://parsbaft.com/images/roblox-shinobi-life-level-hack.pdfIn PDF document text
- http://iedarelief.us/images/roblox-speed-hacks-that-u-can-t-in-chaty.pdfIn PDF document text
- http://ff-obertraun.at/images/how-to-get-free-stuff-on-roblox-mobile.pdfIn PDF document text
- http://elzet-opakowania.pl/images/best-roblox-free-ex.pdfIn PDF document text
- http://scuttworksdesigns.us/images/how-to-get-free-robux-admin.pdfIn PDF document text
- http://www.agri-tech.com.au/images/free-robux-apk.pdfIn PDF document text
- http://tc-kulmbach.de/images/how-to-get-free-ranks-in-a-roblox-group.pdfIn PDF document text
- http://ghegamethu.vn/images/roblox-cheats-for-operation-scorpion.pdfIn PDF document text
- http://pgk-polaniec.pl/images/bloxy-world-roblox-free-robux.pdfIn PDF document text
- http://gavertrimmers.be/images/free-red-hair-roblox.pdfIn PDF document text
- http://caraless.com/images/you-get-free-robux.pdfIn PDF document text
- http://solidcom.de/images/free-robux-generators-that-actually-works-2021.pdfIn PDF document text
- http://salantiskis.lt/images/stickmasterluke-100b-free-robux.pdfIn PDF document text
+9 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006d37.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6D37	24948 bytes
SHA-256: `dc8824711a50a3ba9d072406e4293805ab765b5ad42215b1935d930d11592c22`
`font_01_sfnt_off0000a6f2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA6F2	3884 bytes
SHA-256: `40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf`
`font_02_sfnt_off0000b39a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB39A	18260 bytes
SHA-256: `2680cdcff4b561ecb4408e03ced08ff26b7777f92b77a13df572625a603e2130`

Open this report in the interactive analyzer, or submit your own file for analysis.