Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6256682f8cb3b54…

MALICIOUS

PDF

54.5 KB Created: 2021-04-06 14:25:50 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 24f1e67504f66edcf9ccfe57778613d7 SHA-1: f62460e5f7f045e24d47bf79278b6a1f98aa68df SHA-256: f6256682f8cb3b5409e31bd994a4baadae7de6f33a8881f122826320293ee3cd
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8413

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
    • https://sitam.co.in/images/how-to-hack-war-games-roblox.pdfIn PDF document text
    • http://uctovnictvosnv.sk/images/how-to-get-free-robux-on-mobile.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/roblox-hack-xbox-one.pdfIn PDF document text
    • http://stroygrad-spb.com/images/cerberus-hack-roblox-download.pdfIn PDF document text
    • http://hemmet-strand.dk/images/how-to-get-free-black-hair-in-roblox.pdfIn PDF document text
    • http://demenagementlandry.com/images/site-de-hack-roblox-xbox.pdfIn PDF document text
    • http://famoirs.co.uk/images/roblox-hack-client-2021.pdfIn PDF document text
    • http://principessalialaofegypt.com/images/free-robux-phone-number-verification.pdfIn PDF document text
    • http://www.lionel-seppoloni.fr/images/roblox-how-to-hack-booga-booga.pdfIn PDF document text
    • https://komakinosite.jp/images/cherry-how-to-get-free-robux.pdfIn PDF document text
    • http://www.elis-strechy.cz/images/hack-roblox-in-game.pdfIn PDF document text
    • http://florentineholding.com/images/free-account-roblox-obc-2021.pdfIn PDF document text
    • http://condit-pack.com/images/roblox-cheat-engine-patched.pdfIn PDF document text
    • https://beejekorf.nl/images/unlimited-health-hack-roblox.pdfIn PDF document text
    • http://immo360grad.com/images/how-to-get-book-wings-in-roblox-for-free.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/hcbb-roblox-hack.pdfIn PDF document text
    • https://asesoriamss.com/images/roblox-urbis-level-cheat.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/roblox-area-14-hacking-script-pastebin.pdfIn PDF document text
    • http://io24.com.ar/images/how-to-hack-roblox-one-punch-man.pdfIn PDF document text
    • https://liftkos.com/images/roblox-como-hackear-ropa.pdfIn PDF document text
    • http://infoagronomia.com.ar/images/roblox-2021-hack-attack.pdfIn PDF document text
    • http://clubpure.org/images/how-to-hack-in-roblox-wil-savannah.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/cerberus-hack-program-roblox.pdfIn PDF document text
    • http://www.art-concept.gr/images/roblox-prison-lif-ewall-hacking-2021.pdfIn PDF document text
    • http://serviio.org/images/roblox-free-robux-hack-script.pdfIn PDF document text
    • http://palogar.es/images/filtered-roblox-hack.pdfIn PDF document text
    • http://rosadent.com/images/roblox-jailbreak-noob-vs-pro-vs-hacker.pdfIn PDF document text
    • http://ltdirect.co.uk/images/how-to-get-free-roblox-robux-codes.pdfIn PDF document text
    • http://thehancgroup.com/images/free-roblox-bc-cards.pdfIn PDF document text
    • http://www.guidaturisticaverona.it/images/how-to-hack-dusk-autinum-islands-roblox.pdfIn PDF document text
    • http://per-bittner.de/images/roblox-play-now-for-free-the-scary-elavator.pdfIn PDF document text
    • http://lakeshistory.com/images/hacks-para-roblox-counter-blox-2021.pdfIn PDF document text
    • http://mydevice.com.au/images/free-tdm-shirt-roblox.pdfIn PDF document text
    • http://www.boic.nl/images/roblox-how-to-get-free-vc-with-cheat-engine.pdfIn PDF document text
    • http://asiasieja.pl/images/i-got-hacked-on-roblox.pdfIn PDF document text
    • http://safwafurniture.com/images/hack-roblox-info.pdfIn PDF document text
    • https://eleganceautospa.ca/images/roblox-free-tops.pdfIn PDF document text
    • https://www.cnte.org.br/images/free-robux-no-survey-2021.pdfIn PDF document text
    • http://standart-lab.ru/images/roblox-how-to-get-a-free-dominus.pdfIn PDF document text
    • https://blagvist.com.ua/images/roblox-hack-promo-codes.pdfIn PDF document text
    • http://towtrucklosangeles.com/images/roblox-free-robux-online.pdfIn PDF document text
    • http://www.centromedicoaurora.it/images/roblox-hack-tool-download-2021-pc.pdfIn PDF document text
    • http://glll.de/images/roblox-script-adopt-and-raise-a-cute-baby-free-admin.pdfIn PDF document text
    • https://leckeres-geschenk.de/images/free-robux-codes-gift-card.pdfIn PDF document text
    • http://citycare.pt/images/free-robux-no-human-verification-or-downloading-apps.pdfIn PDF document text
    • https://ballaratcaravans.com.au/images/get-free-item-in-roblox.pdfIn PDF document text
    • https://www.lomrad.go.th/images/roblox-character-hack.pdfIn PDF document text
    • http://bilhetim.com.br/images/the-roblox-game-and-online-free.pdfIn PDF document text
    • http://keepcasscountybeautiful.com/images/free-robux-no-human-verification-no-survey-2021.pdfIn PDF document text
    +10 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000071f3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x71F3 27348 bytes
SHA-256: f7bd242ebfe617b39415a30edf100675da2eb5a6fef8716f2648d5c126746f09
font_01_sfnt_off0000aeb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAEB8 19088 bytes
SHA-256: d1202c214ae02efc759e068da07dc81a29da4e97d39b91e2e96410e281f716a2

Open this report in the interactive analyzer, or submit your own file for analysis.