Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7909bd8baaad7f8…

MALICIOUS

PDF

59.9 KB Created: 2021-04-05 20:13:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 01b2f64bae18ebb7fa5f0b1f2bcd7d40 SHA-1: 73a971387a02c706df9e4f5a0266dd4a8f3b7bbe SHA-256: f7909bd8baaad7f8a383991ff73409e680bf8b1a77f0da8a8f1861956f3d8894
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links to websites that claim to offer free Robux or game hacks, as indicated by the 'PDF_GAME_HACK_SEO_LINK_FARM' heuristic. The document body and extracted URLs overwhelmingly point to scam-related content, suggesting a phishing or social engineering attack. No scripts were extracted, but the primary attack vector appears to be directing users to malicious external URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6774

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-robux-no-password-or-download PDF link annotation
    • https://www.dressel-immobilien-mv.de/images/como-conseguir-robux-hack-2021.pdfIn PDF document text
    • http://wireprod.net/images/hacking-roblox-accounts-cheat-engine.pdfIn PDF document text
    • http://ptts.pl/images/roblox-noclip-hack-download-2021.pdfIn PDF document text
    • http://kids-academy.pl/images/roblox-robux-money-hack-tool-generator.pdfIn PDF document text
    • http://xn--apartementos-smfora-cala-ratjada-4vc.de/images/free-robux-code-that-everyone-can-use.pdfIn PDF document text
    • https://pa-waingapu.go.id/images/proxo-hack-roblox-2021.pdfIn PDF document text
    • https://www.saisystem.it/images/one-piece-millenium-roblox-stats-hack.pdfIn PDF document text
    • http://businessmart.ro/images/hack-robux-codes.pdfIn PDF document text
    • http://eooe.gr/images/free-roblox-hair-names.pdfIn PDF document text
    • https://liceucastrodelapenya.com/images/dhow-do-get-free-robux.pdfIn PDF document text
    • http://dcmetroapp.com/images/roblox-how-to-hack-grand-blox-auto-with-cheat-engine.pdfIn PDF document text
    • http://www.torvet11.dk/images/download-roblox-music-for-free.pdfIn PDF document text
    • http://www.adravietnam.org/images/free-robux-no-buying-games.pdfIn PDF document text
    • http://texnes-plus.gr/images/free-robux-script-pastebin-2021.pdfIn PDF document text
    • http://kruiz21.ru/images/dragon-ball-x-in-roblox-hack-pastebin.pdfIn PDF document text
    • https://www.essentracomponents.com.my/images/free-robux-100-working-pastebin.pdfIn PDF document text
    • https://pa-pangkalpinang.go.id/images/how-to-get-bc-on-roblox-for-free-2021.pdfIn PDF document text
    • http://viemeo.fr/images/hack-roblox-cheat-engine-64.pdfIn PDF document text
    • http://kulturlandschaften.eu/images/hacker-de-robux-para-roblox-real.pdfIn PDF document text
    • http://www.viniperfetti.com/images/gamehackbiz-roblox.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/roblox-animatronic-world-hack.pdfIn PDF document text
    • http://www.copoint.co.uk/images/blockland-free-robux.pdfIn PDF document text
    • http://kita-lollipop.ch/images/watch-ads-to-earn-free-robux.pdfIn PDF document text
    • http://pa-tanjungselor.go.id/images/free-account-login-and-password-roblox.pdfIn PDF document text
    • https://enpav.it/images/roblox-radio-script-pastebin-hack.pdfIn PDF document text
    • http://gbp-trabkiwielkie.pl/images/free-roblox-games-that-you-dont-have-to-sine-in.pdfIn PDF document text
    • https://pagadder.com/images/roblox-cursor-hack-lock.pdfIn PDF document text
    • http://agrupamentoescolas-alfredo-da-silva.com/images/free-roblox-rap-songs.pdfIn PDF document text
    • https://scraperite.com/images/easy-how-to-get-free-robux.pdfIn PDF document text
    • http://buvis.is/images/roblox-free-group-ad.pdfIn PDF document text
    • http://xn--59-6kcusgqlmfgen3m.xn--p1ai/images/roblox-ps3-download-free.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/roblox-jailbreak-money-hack-2021-november.pdfIn PDF document text
    • http://www.gearestauri.it/images/roblox-hack-2021-free-robux.pdfIn PDF document text
    • http://nevesomost.by/images/free-wins-in-anarchy-roblox.pdfIn PDF document text
    • http://wireprod.net/images/roblox-om-nom-dimulator-hack.pdfIn PDF document text
    • http://standart-lab.ru/images/how-to-hack-audio-in-roblox.pdfIn PDF document text
    • https://sitam.co.in/images/roblox-what-do-you-do-when-your-account-gets-hacked.pdfIn PDF document text
    • http://ferienwohnung-walker.de/images/robux-apk-free.pdfIn PDF document text
    • https://europainstitut.hu/images/how-to-get-free-robux-mythical-chaos.pdfIn PDF document text
    • https://www.vacationrentalsincroatia.com/images/hack-tshirt-roblox.pdfIn PDF document text
    • http://legitame.org/images/hack-adopt-me-roblox-2021.pdfIn PDF document text
    • https://www.milewood.co.uk/images/free-robux-disney-quiz.pdfIn PDF document text
    • https://www.devries-group.de/images/robux-hack-without-verification-required.pdfIn PDF document text
    • http://techmobil.pl/images/cheat-engine-roblox-windows-8.pdfIn PDF document text
    • https://www.anagoria.com/images/roblox-dinosaur-simulator-dna-hack.pdfIn PDF document text
    • https://www.ncscolour.no/images/free-blank-roblox-shirt-templates.pdfIn PDF document text
    • http://bau-lk.de/images/gamepasses-free-pastebin-roblox.pdfIn PDF document text
    • https://corbo.ru/images/how-to-get-free-robux-by-using-inspect.pdfIn PDF document text
    • https://www.impactfoods.co.uk/images/free-group-in-roblox.pdfIn PDF document text
    +14 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008261.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8261 25832 bytes
SHA-256: 1b83b1a1362134134e91b26a136f485f02bcd2b3c2f91741d7961c4a8186bb5f
font_01_sfnt_off0000bc13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC13 2832 bytes
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2
font_02_sfnt_off0000c5c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5C4 18564 bytes
SHA-256: 4cf8e7dd12db67a696c810854e21ccdcd92c97b76316993706b54a4e470438c6