PDF malware analysis — malicious · f7126229d77d5a9a

MALICIOUS

PDF

65.3 KB Created: 2021-04-06 06:40:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-11

MD5: dd18fe9102f8631d61b58570f8f1d69d SHA-1: 73213ffb587c7fe169a24472651018ffc11b564d SHA-256: f7126229d77d5a9a381ea866e03742393706ad9b2573265fa8261e41b0b3387c

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a heuristic firing indicating it links to a 'free generator / game hack' redirector, which is a common lure for malicious downloads. The document body also contains a URL that appears to be related to game hacks. This suggests the document's primary purpose is to trick users into clicking a malicious link to obtain a game hack, likely leading to malware.

Machine Learning

Nyx PDF Classifier malicious score 0.6301

Heuristics 4

PDF links to a 'free generator / game hack' redirector critical PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean. CRITICAL on its own: the /app/<id>/<slug>-game-hack path shape is unambiguous scam infra, and the host rotates so a host-list match can't be relied on.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://ivanflores.cl/images/roblox-vehicle-simulator-miles-hack.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/roblox-hack-how-to-load-gui.pdfIn PDF document text
- https://www.lomrad.go.th/images/robux-at-roblox-tody-for-free.pdfIn PDF document text
- https://www.hbproducts.dk/images/roblox-free-clothes-in-catalog.pdfIn PDF document text
- http://svp-steinmaur.ch/images/free-robux-penut.pdfIn PDF document text
- http://chehovchanka-info.ru/images/roblox-games-to-play-for-free-online.pdfIn PDF document text
- http://www.awakeningtruth.org/images/how-to-hack-roblox-admin.pdfIn PDF document text
- http://www.boutique-nature.fr/images/roblox-pizza-cheat-engine-script.pdfIn PDF document text
- http://eventgo.fr/images/bit-slicer-hack-jump-roblox.pdfIn PDF document text
- https://www.lomrad.go.th/images/how-to-get-robux-in-roblox-for-free-2021.pdfIn PDF document text
- http://jasperfirstumc.com/images/how-to-get-free-robux-on-roblox-pc-2021.pdfIn PDF document text
- http://www.gadanie.lv/images/how-does-people-uses-hacks-in-roblox-jailbreak.pdfIn PDF document text
- https://www.tsdb.com.au/images/roblox-free-jailbreak-vip-server.pdfIn PDF document text
- http://autenticohostalsalou.com/images/pain-exist-roblox-hack.pdfIn PDF document text
- https://www.ncscolour.no/images/clothes-for-roblox-free.pdfIn PDF document text
- http://prodent.com.ua/images/hack-roblox-admin-dl.pdfIn PDF document text
- http://italymania.ru/images/how-to-actually-get-1-000-free-robux.pdfIn PDF document text
- https://www.millatgears.com/images/websites-to-get-free-robux-no-human-verification.pdfIn PDF document text
- https://www.hofe-gmbh.de/images/roblox-how-to-customize-your-character-for-free.pdfIn PDF document text
- http://lakomat.by/images/free-admin-for-every-game-on-roblox.pdfIn PDF document text
- http://abqwinair.com/images/cheat-engine-roblox-survive-the-disasters.pdfIn PDF document text
- http://medinup.pt/images/robux-free-generator-no-survey-legit.pdfIn PDF document text
- http://www.pcclawyers.com.au/images/free-robux-free-real.pdfIn PDF document text
- http://www.mikramarine.gr/images/how-to-use-cheat-engine-on-roblox.pdfIn PDF document text
- http://uctovnictvosnv.sk/images/hacks-for-roblox-phantom-forces-2021.pdfIn PDF document text
- http://safetin.ru/images/5-games-that-give-out-free-robux.pdfIn PDF document text
- https://www.porthos.it/images/how-to-cheat-engine-debug-roblox-without-crash.pdfIn PDF document text
- http://rafaelmontesinos.com/images/free-robux-hack-no-apps.pdfIn PDF document text
- http://androidthai.in.th/images/how-to-hack-roblox-games-without-cheat-engine-2021.pdfIn PDF document text
- http://thomas-hartl.at/images/new-hack-for-roblox-2021-december-download-mediafire.pdfIn PDF document text
- http://erptrends.com/images/roblox-free-candy-van-script-pastebin.pdfIn PDF document text
- https://corbo.ru/images/inject-hack-free-robux.pdfIn PDF document text
- http://bowling-am-froschpark.de/images/free-robux-team-panda.pdfIn PDF document text
- http://www.actae.gr/images/free-limited-roblox-items.pdfIn PDF document text
- http://lechia-sedziszow.pl/images/how-to-get-free-robux-2021.pdfIn PDF document text
- http://interpretation-dessins-enfants.net/images/auto-clicker-for-mac-roblox-free-2021.pdfIn PDF document text
- http://www.domkiletniskowe-wladyslawowo.pl/images/como-psar-el-bosque-roblox-free-pokemon-brick-bronze-beta.pdfIn PDF document text
- https://www.dachytarasowe.eu/images/how-to-get-free-vip-on-any-server-on-roblox.pdfIn PDF document text
- https://fkg.usu.ac.id/images/free-jump-hacks-for-roblox.pdfIn PDF document text
- http://ipdrs.org/images/stickmasterluke-100b-free-robux.pdfIn PDF document text
- https://open-coffee-drimmelen-geertruidenberg.nl/images/roblox-booga-booga-mojo-hack.pdfIn PDF document text
- https://www.wildpark-johannismuehle.de/images/john-doe-roblox-hacking.pdfIn PDF document text
- https://www.albisser.ch/images/hacks-for-roblox-csgo.pdfIn PDF document text
- http://skwolcott.com/images/roblox-prop-boat-free.pdfIn PDF document text
- http://www.mediaxin.net/images/beyblade-roblox-beta-damage-hack.pdfIn PDF document text
- http://ilcommercialista.info/images/download-free-cool-roblox-boy-outfits.pdfIn PDF document text
- https://www.solucionesdigit.com/images/hacks-electric-state-roblox.pdfIn PDF document text
- https://www.milewood.co.uk/images/roblox-hack-v2-1.pdfIn PDF document text
- http://sdservicesrl.it/images/download-roblox-for-free-pc.pdfIn PDF document text
+14 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000086d0.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x86D0	38964 bytes
SHA-256: `8c958c5c6ee94c1126aaf34ec88f838f0c780227eded35987f596b29d8d3c84f`
`font_01_sfnt_off0000da1d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDA1D	19072 bytes
SHA-256: `b35726514abdd5d05ff8c06df9cf44267be0582a55050a5309a44a55c44d90a1`

Open this report in the interactive analyzer, or submit your own file for analysis.