Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8ea72a61f4989d2…

MALICIOUS

PDF

253.6 KB Created: 2021-04-05 04:39:31 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 1df2c14f260522ca126196a76254bfd7 SHA-1: b0d07c737ac166d0f0eb70b0deb145e546b7e507 SHA-256: f8ea72a61f4989d2ceb82d9a791a86cd66ceca7ea936c84481048b90fd409464
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Pdf.Phishing.Roblox062100-9873116-0, indicating a phishing attempt related to Roblox. The presence of an external URI pointing to a 'cheat engine' and a visual download button lure further supports this. Although no scripts were extracted, the PDF structure and embedded URLs suggest an attempt to trick users into downloading potentially malicious software.

Machine Learning

  • Nyx PDF Classifier clean score 0.1052

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-boxing-simulator-cheat-engine PDF link annotation
    • http://www.remiauclair.fr/images/roblox-hacks-mad-city-script.pdfIn PDF document text
    • http://piadaandco.it/images/hack-para-conseguir-dientes-gratis-en-sharkbite-roblox.pdfIn PDF document text
    • http://www.arredifunebri.com/images/roblox-flood-escape-to-how-to-get-fly-hacks.pdfIn PDF document text
    • http://grand-ural74.ru/images/roblox-robux-hack-no-human-verification-2021.pdfIn PDF document text
    • https://www.mvp.co.nz/images/hack-de-robux-2021-mayo.pdfIn PDF document text
    • http://lakomat.by/images/roblox-jailbreak-hack-download-2021.pdfIn PDF document text
    • http://southernhills-golf.com/images/face-roblox-free.pdfIn PDF document text
    • http://bagna.pl/images/how-to-hack-roblox-accounts-password.pdfIn PDF document text
    • http://kermas.eu/images/roblox-followers-hack.pdfIn PDF document text
    • http://pdapanache.com/images/roblox-its-not-free.pdfIn PDF document text
    • https://technospektr.com.ua/images/roblox-code-free-robux.pdfIn PDF document text
    • https://rincondelentrenador.com/images/roblox-phantom-force-hack.pdfIn PDF document text
    • http://www.prylfabriken.se/images/infinite-jump-hack-roblox-download.pdfIn PDF document text
    • http://riccardodurso.it/images/how-to-get-1m-robux-for-free-2021.pdfIn PDF document text
    • https://www.air-shop.cz/images/shadow-raid-loot-cheats-roblox-notoriety.pdfIn PDF document text
    • http://www.malonmalon.com.ar/images/free-robux-pastebin-no-subscribe.pdfIn PDF document text
    • http://fradiomas.com/images/free-roblox-accounts-2021-september.pdfIn PDF document text
    • http://bufbd.org/images/earnbux-us-free-robux.pdfIn PDF document text
    • http://bagna.pl/images/how-to-hack-into-a-roblox-server.pdfIn PDF document text
    • http://intrasservices.com/images/hacking-roblox-tags.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00037aff.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37AFF 25740 bytes
SHA-256: ab9c8e7aabe776baaf44e0d6941879f03e0e6382998f7fc6c1b8e77eaad94a64
font_01_sfnt_off0003b3fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B3FA 11440 bytes
SHA-256: 154d59d1680f2d1e38ccb783d6997f344290d121007e51df331726de4128c12e
font_02_sfnt_off0003cf1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CF1B 18484 bytes
SHA-256: 0700953ddb4620237885a791b5f37744dc4cad468169b1e793f0ee7c543df0d0