PDF malware analysis — malicious · 18c29b3611c880ef

MALICIOUS

PDF

50.2 KB Created: 2021-04-02 23:40:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-22

MD5: 241f0165d01f4ca88ee7f819d878ce57 SHA-1: 48c01dc29f81a91592f64ac0e74fc6ee9572fb20 SHA-256: 18c29b3611c880efb5f489cb358622a37e280dcd38f4b28556efcb7e0d748e7a

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by an ML classifier. It uses a fake-CAPTCHA lure. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.8682

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/how-can-i-get-free-robux-without-paying PDF link annotation
- http://www.tamogatoweb.hu/images/how-to-get-free-items-in-roblox-no-pastebin.pdfIn PDF document text
- http://www.jureclomas.com.ar/images/how-to-hack-a-roblox-account-with-inspect-element-2021.pdfIn PDF document text
- http://kids-academy.pl/images/roblox-cheat-engine-64-robux.pdfIn PDF document text
- http://sscclc.edu.ec/images/hack-work-on-roblox-2021.pdfIn PDF document text
- https://bancroftandsons.com/images/rbxboost-earn-free-roblox-robux-by-completing-surveys.pdfIn PDF document text
- http://gingerscience.co.in/images/free-admin-roblox-download.pdfIn PDF document text
- http://www.mjclautrec.fr/images/free-items-hack-roblox.pdfIn PDF document text
- http://learningarabic.co.uk/images/hack-courir-super-vite-roblox-jailbreak.pdfIn PDF document text
- http://www.malonmalon.com.ar/images/free-robux-2021-april.pdfIn PDF document text
- http://www.malonmalon.com.ar/images/free-robux-canada.pdfIn PDF document text
- https://consorziocsa-asicaivano.it/images/free-robux-no-human-verification-or-download-or-survey.pdfIn PDF document text
- https://www.foodsafety.cz/images/free-roblox-gift-card-codes-2021-working.pdfIn PDF document text
- https://fkg.usu.ac.id/images/free-robux-script-hack.pdfIn PDF document text
- https://www.albisser.ch/images/roblox-hack-cheat.pdfIn PDF document text
- http://zarinnameh.ir/images/bux-life-free-robux.pdfIn PDF document text
- http://www.hawler.in/images/how-to-insert-free-hats-on-roblox.pdfIn PDF document text
- https://www.cpnf.ch/images/hack-on-roblox-to-get-money-for-blox-burg.pdfIn PDF document text
- https://www.albisser.ch/images/how-to-get-free-robux-working-with-roblox.pdfIn PDF document text
- http://www.fanciullovito.it/images/roblox-the-future-cheat-engine.pdfIn PDF document text
- http://www.inservis.cl/images/roblox-friend-hack.pdfIn PDF document text
- http://www.remiauclair.fr/images/yarxvin-roblox-hacks.pdfIn PDF document text
- http://cosver.eu/images/free-robux-codes-no-survey-no-download.pdfIn PDF document text
- https://www.porthos.it/images/get-robux-free-for-reel-no-get-someting-free.pdfIn PDF document text
- https://www.utalii.ac.ke/images/unjailbreak-free-download-roblox.pdfIn PDF document text
- http://aeroclub-kaernten.at/images/free-generator-for-robux.pdfIn PDF document text
- https://tokunfome.com.br/images/roblox-hacks-link-description.pdfIn PDF document text
- http://escolaarboc.cat/images/free-robux-obby-working-2021.pdfIn PDF document text
- https://socialvalue.gr/images/rbxboost-earn-free-roblox.pdfIn PDF document text
- http://www.sapaengineering.kz/images/free-robux-youtube-stream.pdfIn PDF document text
- http://uctovnictvosnv.sk/images/free-robux-generator-no-offers.pdfIn PDF document text
- http://escolaarboc.cat/images/wahoo-free-robux.pdfIn PDF document text
- https://consorziocsa-asicaivano.it/images/hallowen-simualtor-hack-roblox.pdfIn PDF document text
- https://www.albisser.ch/images/free-working-roblox-accounts.pdfIn PDF document text
- http://gops.pruszczgdanski.pl/images/roblox-jojo-blox-hack.pdfIn PDF document text
- http://aeroclub-kaernten.at/images/hack-roblox-comment-passer-a-travers-des-murs-2021.pdfIn PDF document text
- https://corbo.ru/images/free-robux-no-verification-no-survey-2021.pdfIn PDF document text
- http://www.lovecraftiana.com.ar/images/how-to-get-50-robux-for-free-2021.pdfIn PDF document text
- http://www.mikramarine.gr/images/free-roblox-injector.pdfIn PDF document text
- http://portal.crfsp.org.br/images/www-pastebin-com-raw-free-robux-v5.pdfIn PDF document text
- http://www.eurosan1.ba/images/roblox-hack-crazy.pdfIn PDF document text
- http://www.zdravazena.sk/images/get-free-robux-generator-parts-pokemon-silver.pdfIn PDF document text
- http://www.actae.gr/images/roblox-aimbot-hack-2021-august.pdfIn PDF document text
- http://www.fluidtech.hu/images/if-bacon-hair-got-free-robux.pdfIn PDF document text
- http://www.maakherumusic.net/images/how-to-hack-games-on-roblox-2021.pdfIn PDF document text
- http://www.lionel-seppoloni.fr/images/roblox-cheat-engine-bypass-october-2021.pdfIn PDF document text
- http://www.web.stc-part.co.th/images/how-to-get-100-robux-for-free-2021.pdfIn PDF document text
- http://zarinnameh.ir/images/how-to-hack-weight-lifting-sim-in-roblox.pdfIn PDF document text
- http://www.agri-tech.com.au/images/energize-roblox-hack.pdfIn PDF document text
- https://www.foodsafety.cz/images/free-robux-no-human-verification-survey-or-download.pdfIn PDF document text
+2 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000059d1.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x59D1	24128 bytes
SHA-256: `3b5a56eed85ae1c25ea5973e207a648429d33be08b72f701bd9131971ea96684`
`font_01_sfnt_off000090e1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x90E1	3884 bytes
SHA-256: `40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf`
`font_02_sfnt_off00009d88.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9D88	19012 bytes
SHA-256: `4f59d0b9c1e891917bc54e8351ac0c3e73e467f7b2be1593e319860f0aa3f4c1`

Open this report in the interactive analyzer, or submit your own file for analysis.