PDF malware analysis — malicious · 28055fb3c5c45b77

MALICIOUS

PDF

44.1 KB Created: 2021-05-16 19:46:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 1980451e101a65cfbca6b893ae802efc SHA-1: 5ba1724e9e5034bdaf8fb7eb5b89d5b1ed423e9b SHA-256: 28055fb3c5c45b7749b1c13cf80c5dd638b139363605121575388ec0d9981b0c

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA and a call-to-action to download a file, aiming to trick the user into executing malicious content. It embeds multiple URLs, one of which is directly linked to a potential malware download. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9648

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/real-coin-master-hack-game-hack
- https://verdensbarn.no/images/coin-blogspot_GM406889139.pdf
- https://verdensbarn.no/images/coin-master-game-hacks_GM406889139.pdf
- https://verdensbarn.no/images/free-robux-no-verification-required_GM431946152.pdf
- https://verdensbarn.no/images/free-robux-reddit_GM431946152.pdf
- https://verdensbarn.no/images/free-coins-and-spins-coin-master-2021_GM406889139.pdf
- https://verdensbarn.no/images/minecraft-dungeons-download-free_GM479516143.pdf
- https://verdensbarn.no/images/free-robux-glitch-2021_GM431946152.pdf
- https://verdensbarn.no/images/minecraft-hack-app_GM479516143.pdf
- https://verdensbarn.no/images/free-robux-live_GM431946152.pdf
- https://verdensbarn.no/images/how-to-earn-free-robux_GM431946152.pdf
- https://verdensbarn.no/images/coin-master-server-hack_GM406889139.pdf
- https://verdensbarn.no/images/hack-coin-master-using-pc_GM406889139.pdf
- https://verdensbarn.no/images/claim-roblox_GM431946152.pdf
- https://verdensbarn.no/images/how-to-free-robux_GM431946152.pdf
- https://verdensbarn.no/images/coin-master-free-spin-no-offers_GM406889139.pdf
- https://verdensbarn.no/images/how-to-get-robux-for-free-2021_GM431946152.pdf
- https://verdensbarn.no/images/roblox-hacked-com-2021_GM431946152.pdf
- https://verdensbarn.no/images/coin-master-free-spin-and-coin-links_GM406889139.pdf
- https://verdensbarn.no/images/coin-master-free-spins-link-download_GM406889139.pdf
- https://verdensbarn.no/images/robux-hack-2021_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004800.bin` `20322f64713ce61a31554f010d5045ac958dca2fcf5d90433d0717bd0a900f2d`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4800	24992 bytes
`font_01_sfnt_off000080e5.bin` `fcfcd28869b8d6c7503d63ed8d48371ec5b580fea2733193e2acbb82b3d30a76`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x80E5	2944 bytes
`font_02_sfnt_off00008b0f.bin` `c971b34c329d205054a16b1b5f827a74783bca0f841d374511d085dfea161b8f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B0F	17788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.