Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7a1f9ae0a0cf2a6…

MALICIOUS

PDF

238.7 KB Created: 2021-04-05 05:44:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 125658dbd9a6d16a38ea056bad1fc8f3 SHA-1: 165b9622c50be8d3fcfba53e3bce67118c3bb194 SHA-256: f7a1f9ae0a0cf2a62265891f71500ad49f4428077b657fe123ff7c218bbc0469
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5773

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/r1-roblox-hack PDF link annotation
    • http://www.mjclautrec.fr/images/its-free-roblox-id.pdfIn PDF document text
    • http://erntefest2016.de/images/how-to-get-robux-for-free-2021-july.pdfIn PDF document text
    • https://rieber-transporte.de/images/roblox-saber-sim-hacks.pdfIn PDF document text
    • http://eltisstudio.sk/images/como-hacker-roblox-en-ordenador-en-1-paso-robux-free.pdfIn PDF document text
    • http://selectionspdf.fr/images/get-newer-phone-for-free-robux.pdfIn PDF document text
    • http://gestibrok.com/images/roblox-cheats-how-to-get-free-robux-2021.pdfIn PDF document text
    • http://www.beged.at/images/free-pants-and-shirts-roblox.pdfIn PDF document text
    • http://axia-verlag.at/images/hack-roblox-injector.pdfIn PDF document text
    • http://icomsolutions.com.au/images/best-free-roblox-stuff.pdfIn PDF document text
    • http://wattkit.com/images/poste-eybens-free-robux.pdfIn PDF document text
    • http://androidthai.in.th/images/free-robux-gift-codes.pdfIn PDF document text
    • https://semanasantacehegin.com/images/free-roblox-login-name-and-password.pdfIn PDF document text
    • http://evp-sanorlenok.ru/images/roblox-cheating-text-scripts.pdfIn PDF document text
    • http://babbibooth.com/images/roblox-free-flying-practice-place.pdfIn PDF document text
    • https://gzog.pl/images/buzz-the-bee-robux-hack.pdfIn PDF document text
    • http://forsazh-51.ru/images/how-to-get-free-robux-in-roblox-inspect.pdfIn PDF document text
    • https://koeltotaal.com/images/jeux-de-free-roblox.pdfIn PDF document text
    • http://the-specials.ch/images/hacker-destroza-la-ciudad-roblox-pokemon-gomiannn.pdfIn PDF document text
    • http://armatrutz.de/images/get-free-roblox-gift-cards.pdfIn PDF document text
    • http://shootawayproduction.com/images/free-robux-bettergenerator-us.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000368d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x368D0 21368 bytes
SHA-256: c658495a4832f3d165c754f4793563222aa0d17381884c8d85fe0a883c8acdd8
font_01_sfnt_off0003975d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3975D 17376 bytes
SHA-256: b1cb6afe4065d4ab273c379ec111cb125313401abf7448441bbe390527062f74

Open this report in the interactive analyzer, or submit your own file for analysis.