Malicious PDF — malware analysis report

Static analysis result for SHA-256 26f6d74d936beaa0…

MALICIOUS

PDF

34.8 KB Created: 2021-06-27 14:12:45 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: db5c937729288957584141e98e8a8dcb SHA-1: 2791fb5be25eccf36b5be70e966f4af300beabb1 SHA-256: 26f6d74d936beaa0592da51da412fa5e568b3d4d559df0641ee33f1bb8762e85
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is a PDF document that displays a fake CAPTCHA or human verification prompt, a common lure for users seeking game cheats or hacks. It contains an embedded URI pointing to a URL that offers a 'roblox-robux-hack-generator-download-game-hack', strongly suggesting the document's purpose is to facilitate the download of potentially malicious software. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-robux-hack-generator-download-game-hack
    • https://www.cow-style.com.tw/upload/files/pokemon-go-joystick-ios-2021-free_GM1094591345.pdf
    • https://www.cow-style.com.tw/upload/files/minecraft-apk-114_GM479516143.pdf
    • https://www.cow-style.com.tw/upload/files/roblox-apocalypse-rising-hack_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/codes-for-roblox-to-get-free-robux_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/how-to-create-a-minecraft-server-for-free_GM479516143.pdf
    • https://www.cow-style.com.tw/upload/files/coin-master-35-2-hack_GM406889139.pdf
    • https://www.cow-style.com.tw/upload/files/free-robux-no-survey_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/how-do-you-get-free-robux-without-doing-anything_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/xray-mod-minecraft-114_GM479516143.pdf
    • https://www.cow-style.com.tw/upload/files/free-coin-master-account_GM406889139.pdf
    • https://www.cow-style.com.tw/upload/files/free-robux-hack-2021_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/free-robux-glitch-2021_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/robux-free-com_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/earn-free-robux-by-installing-apps_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/free-robux-generator-no-download-no-surveys-2021_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/hacker-minecraft-song_GM479516143.pdf
    • https://www.cow-style.com.tw/upload/files/uprobuxcom-free-robux_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/pokmon-go-free-download-apk_GM1094591345.pdf
    • https://www.cow-style.com.tw/upload/files/hacks-for-free-robux-2021_GM431946152.pdf
    • https://www.cow-style.com.tw/upload/files/free-robux-no-human-verification-and-no-survey_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003006.bin
6734e1cb41e08b18a6e52f52f3a34615b277744701e9b2f57da21c3be90d7575
pdf-font-stream PDF embedded font (sfnt) at offset 0x3006 22428 bytes
font_01_sfnt_off000061d7.bin
3f3e053a56c1dd7d326642687cae590a05098306bdd5d2814c3b8f5156e854d6
pdf-font-stream PDF embedded font (sfnt) at offset 0x61D7 19404 bytes