Malicious PDF — malware analysis report

Static analysis result for SHA-256 1192d31503fba3d1…

MALICIOUS

PDF

46.1 KB Created: 2021-06-11 10:18:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 74f90571173b72027b2693f8306de106 SHA-1: 38a4191c7b97b1458d6759a9a6f0303ffc179f1e SHA-256: 1192d31503fba3d102d05e1e6d77a123fe254ba61bb5ce525c425f11c3d30b2f
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document displays a fake CAPTCHA to trick users into interacting with it, likely leading to the download of a second-stage payload from the embedded URLs. The ML classifier also flagged this PDF as malicious. No scripts were extracted, but the presence of external URIs and the fake CAPTCHA heuristic strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-my-account-was-hacked-what-do-i-do-game-hack
    • http://stomatoloska-ordinacija-rijeka.com/files/coin-master-hack-using-cheat-engine_GM406889139.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/how-to-get-minecraft-windows-10-for-free-2021_GM479516143.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/coin-master-links-free-spins_GM406889139.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/coin-master-mod-version-free-download-34-4_GM406889139.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/get-free-robux-info_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/coin-master-how-to-get-japan-sushi-card-free_GM406889139.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/minecraft-bedrock-free-download_GM479516143.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/free-robux-generator-without-human-verification_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/free-minecraft-com_GM479516143.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/real-free-robux-codes_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/free-roblox-promo-codes-for-robux_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/how-to-hack-roblox-on-mobile_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/www-free-robux-com_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/free-minecraft-skins_GM479516143.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/youtube-roblox-get-free-money-on-rocitizens-august_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/free-robux-no-human-verification-or-survey-or-download_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/blox-land-free-robux_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/coin-master-heaven-free-spins-today_GM406889139.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/coin-master-free-spins-no-verification_GM406889139.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/roblox-games-that-give-you-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000522b.bin
c4f132de488d7513c9c9f199ba7974fb9649e3e05f25160568f9d3971b7c0e82		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x522B 25808 bytes
font_01_sfnt_off00008e11.bin
871d85ef635ae580dfd1e961777b010a25fa0b35f64139792079ed8f56cd63b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E11 19508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.