PDF malware analysis — malicious · 028e5997d6f87272

MALICIOUS

PDF

41.3 KB Created: 2021-05-13 13:04:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: adcf1695a338bc50af8a11ec7e37ba66 SHA-1: c209d1360a0d53782cfea99ab54f87ac9cc00252 SHA-256: 028e5997d6f87272501504294e8d9418da4c03b8768118da3a5536af8c67b229

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a lure for 'free Robux' and employs a fake CAPTCHA to trick the user into interacting with a malicious link. The primary malicious URL identified is https://netcdn.xyz/app/431946152/free-robux-for-kids-game-hack, which is likely intended to deliver a secondary payload or lead to further phishing attempts. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-robux-for-kids-game-hack
- http://www.eucorro.com/arquivos/files/coin-master-free-spin-realme-products_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/coin-master-hack-ios-app_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/can-you-earn-robux_GM431946152.pdf
- http://www.eucorro.com/arquivos/files/hacks-for-coin-master_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/roblox-scam_GM431946152.pdf
- http://www.eucorro.com/arquivos/files/how-to-get-free-robux-without-downloading-any-apps_GM431946152.pdf
- http://www.eucorro.com/arquivos/files/hack-coin-master-apk-2021_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/collect-free-spin-linms-coin-master_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/coin-master-hack-spin-generator-tool_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/free-coin-master-hack-no-verification_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/coin-master-game-hacks_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/daily-free-spins-on-coin-master_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/how-to-get-free-robux-without-paying_GM431946152.pdf
- http://www.eucorro.com/arquivos/files/roblox-royale-high-diamond-hack_GM431946152.pdf
- http://www.eucorro.com/arquivos/files/what-is-coin-master-app_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/free-robux-codes-2021_GM431946152.pdf
- http://www.eucorro.com/arquivos/files/minecraft-cheats-switch_GM479516143.pdf
- http://www.eucorro.com/arquivos/files/coin-master-no-download-app-but-play-for-free_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/free-coin-master-app_GM406889139.pdf
- http://www.eucorro.com/arquivos/files/coin-master-free-cards-link_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000046d4.bin` `c87273580767f0b05089ef3d5b186b5e63232165e4b445738f9e338cb91e333c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x46D4	24436 bytes
`font_01_sfnt_off00007f0b.bin` `763c1f2cd60606b291f89f2a80f52d083a3bf80be883c0f2186ef0e0ffb8dff5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F0B	18308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.