PDF malware analysis — malicious · f8f8af4321e52dd0

MALICIOUS

PDF

52.1 KB Created: 2021-04-07 02:57:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-23

MD5: b207b10186d4d88b6f6d69eb59b51b3c SHA-1: 468e73c081b7c03b300a6e1c867432d064c93442 SHA-256: f8f8af4321e52dd0b1825de7c372e0d45872ce06d56f7c3df45ca997256b532e

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.8896

Heuristics 5

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE

PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://enigmagenerator.com/app/431946152/roblox-game-hack PDF link annotation
- http://nod74.ru/images/free-robux-coupons.pdfIn PDF document text
- http://apcupschennai.com/images/how-to-get-free-robux-promo-codes-2021-june.pdfIn PDF document text
- http://hondenspecialist-engelien.nl/images/pastbin-robux-hack.pdfIn PDF document text
- http://sscclc.edu.ec/images/roblox-follow-flamingo-hack.pdfIn PDF document text
- http://bagliomangiapane.com/images/free-bikini-roblox.pdfIn PDF document text
- https://www.vacationrentalsincroatia.com/images/free-cool-clothes-on-roblox.pdfIn PDF document text
- http://www.fluidtech.hu/images/free-roblox-card-generater.pdfIn PDF document text
- http://ff-obertraun.at/images/roblox-money-generator-free-download.pdfIn PDF document text
- http://ralf-gryga.de/images/hack-give-robux.pdfIn PDF document text
- http://www.marambio.com.ar/images/how-to-hack-roblox-dungeon-quest-of-items.pdfIn PDF document text
- https://www.hobbypcb.com/images/how-to-get-cool-shirts-for-free-in-roblox.pdfIn PDF document text
- http://uctovnictvosnv.sk/images/how-to-get-free-robux-no-verification-2021.pdfIn PDF document text
- https://www.acoustiguard.com/images/fightforglorton-free-l-robux.pdfIn PDF document text
- http://www.sapaengineering.kz/images/roblox-hack-download-pc-dungeon.pdfIn PDF document text
- http://beer-holzhaus.ch/images/roblox-gravity-cheat-engine.pdfIn PDF document text
- http://kermas.eu/images/free-robux-generator-no-survey-2021.pdfIn PDF document text
- http://progressgel.ru/images/nocliap-hack-for-roblox.pdfIn PDF document text
- http://tehergumi.hu/images/how-to-look-like-a-roblox-hacker.pdfIn PDF document text
- https://corbo.ru/images/cheat-roblox-granny.pdfIn PDF document text
- https://yarburservices.ru/images/hacks-abd-tricks-for-roblox.pdfIn PDF document text
- http://www.lionel-seppoloni.fr/images/alphalife-roblox-cheats.pdfIn PDF document text
- http://cmme.it/images/roblox-bleu-hack.pdfIn PDF document text
- http://fotoclub3b.it/images/free-robux-with-recapcha.pdfIn PDF document text
- https://verdensbarn.no/images/roblox-sword-fighting-hack.pdfIn PDF document text
- http://firstaidacademy.be/images/hack-jump-roblox.pdfIn PDF document text
- http://beer-holzhaus.ch/images/how-to-add-script-on-roblox-hack.pdfIn PDF document text
- http://news123.it/images/fulflex-roblox-hack.pdfIn PDF document text
- http://vagency.us/images/roblox-cheats-for-robux-and-tix-2021.pdfIn PDF document text
- http://cristalysoptic.com/images/free-bombox-on-roblox.pdfIn PDF document text
- http://wcasrock.org/images/can-someone-hack-your-personal-information-from-roblox.pdfIn PDF document text
- http://www.colledellaselva.it/images/hack-roblox-info.pdfIn PDF document text
- http://pastelli.gr/images/free-robux-no-verification-2021-mobile.pdfIn PDF document text
- http://beer-holzhaus.ch/images/roblox-robux-hack-page.pdfIn PDF document text
- http://www.eurosan1.ba/images/comment-hacker-sur-roblox-pc.pdfIn PDF document text
- https://amatq.ca/images/new-cheat-in-roblox-2021.pdfIn PDF document text
- http://bibliotheque-perrigny-les-dijon.fr/images/do-roblox-hacks-work.pdfIn PDF document text
- http://evp-sanorlenok.ru/images/free-roblox-pin-t-shirt.pdfIn PDF document text
- http://axia-verlag.at/images/hack-roblox-money-2021.pdfIn PDF document text
- http://www.art-concept.gr/images/how-to-hack-money-in-gas-station-simulator-roblox.pdfIn PDF document text
- http://pia2000.net/images/can-u-make-clothes-for-free-on-roblox.pdfIn PDF document text
- http://artenossa.net.br/images/how-to-cheat-in-money-in-roblox.pdfIn PDF document text
- https://www.ncscolour.no/images/how-to-get-free-item-on-roblox-2021.pdfIn PDF document text
- http://firstaidacademy.be/images/beta-this-obby-to-get-free-robux.pdfIn PDF document text
- https://wandersuechtig.de/images/i-got-my-account-hacked-on-roblox.pdfIn PDF document text
- http://www.cosver.nl/images/free-roblox-accounts-dump.pdfIn PDF document text
- http://jobsy.com.sg/images/cheat-codes-for-phantom-forces-roblox.pdfIn PDF document text
- http://e-onlinearchiv.de/images/how-to-hack-on-vehicle-sim-roblox.pdfIn PDF document text
- http://dcmetroapp.com/images/free-tix-generator-roblox.pdfIn PDF document text
- http://bodyguardsecurityservices.com.au/images/how-to-hack-free-robux-no-human-verification.pdfIn PDF document text
+17 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00006e04.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x6E04	24688 bytes
SHA-256: `dd5bd00d47df0588cae0b220c097b7406e944164cecc63fe52f6a1c6f86505fc`
`font_01_sfnt_off0000a6e4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA6E4	18528 bytes
SHA-256: `1b3cb4c6a8d1804755c5e0a203419507cbf9294b8f04477d1e93d1ae04a442e4`

Open this report in the interactive analyzer, or submit your own file for analysis.