Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bd36007bcd66fe5…

MALICIOUS

PDF

45.5 KB Created: 2021-06-09 14:41:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 1d66d89f3abf910254c73a88094642ef SHA-1: 81433714f443fd0cfe1e1017f71506fdf2392190 SHA-256: 0bd36007bcd66fe588411e2f673cd4615389fc080a81d1942ae7c0fc8df634a7
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document employs a fake CAPTCHA lure to deceive users into interacting with malicious links, likely for credential harvesting or further payload delivery. The document body and embedded URLs suggest a theme of 'free Robux' or game hacks, a common lure for phishing and malware distribution. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate malicious intent, potentially involving JavaScript execution for malicious actions.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 5

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/how-to-get-free-robux-june-2021-game-hack
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/coin-master-ids-for-free-spins_GM406889139.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/free-executor-roblox_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/free-coins-coin-master-no-human-verification_GM406889139.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/how-to-hack-minecraft_GM479516143.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/download-minecraft-java-edition-free_GM479516143.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/roblox-btools-hack-jailbreak_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/roblox36com-free-robux_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/how-to-get-robux-for-free-2021_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/a-code-that-gives-you-free-robux_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/roblox-free-robux_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/get-me-free-robux_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/free-spins-and-coins-on-coin-master_GM406889139.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/roblox-hacked-version-download_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/robuxy-com-free-robux_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/free-robux-no-verification-2021_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/free-robux-no-verification-or-survey_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/como-conseguir-monedas-infinitas-y-tiradas-de-coin-master-hack_GM406889139.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/free-roblox-cards-live_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/free-robux-no-verification-needed_GM431946152.pdf
    • http://xn--80adcduozbpo4eve.xn--p1ai/images/roblox-hack-free-robux-2021_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000051c9.bin
38c64f30572da240558dbefe35c5758da445c16647b7de0f3045487d7e7d1b14		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x51C9 25608 bytes
font_01_sfnt_off00008d4e.bin
2753cc09e03abd2d71a50a89fec7321ad6bae08e2a7832cb639d1f014797afb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D4E 18848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.