Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b9a58838c504a5a…

MALICIOUS

PDF

45.7 KB Created: 2021-06-10 16:53:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 834871f191692044c1f5746c1a5c1307 SHA-1: d89e90cb8d621c81326f49dd66c01c6b74ea68ac SHA-256: 2b9a58838c504a5a10afa6bb750d08ebce0babed3ffed6f8d86a3b653a5fc4ea
220 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains invisible links that lead to fake CAPTCHA pages, a common lure for tricking users into downloading malware or visiting scam sites. The heuristic 'SE_FAKE_CAPTCHA_CLICKFIX' specifically indicates a pattern combining fake CAPTCHA prompts with instructions to run commands, suggesting a malicious intent to execute arbitrary code. The embedded URLs point to sites offering 'free Robux' or 'hacks', further reinforcing the scam/phishing nature of the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 6

  • Fake CAPTCHA with command-running instructions critical SE_FAKE_CAPTCHA_CLICKFIX
    Document combines fake CAPTCHA or human-verification language with instructions to paste or run a command — a high-confidence ClickFix pattern
  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/how-to-get-free-robux-without-captcha-game-hack
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/free-tiktok-followers-no-human-verification-or-survey_GM835599320.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/hacks-of-roblox-for-cmds_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/map-free-robux-card-code-2021_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/roblox-murder-mystery-free-hacks_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/funny-free-roblox-stuff_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/minecraft-windows-10-hacks_GM479516143.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/speed-hack-easy-roblox_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/how-to-get-free-robux-on-computer-fast-2021_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/free-robux-2021-xyz_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/free-robux-codes-generator_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/in-roblox-how-do-you-hack-accounts_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/roblox-hack-mod-menu-android_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/free-games-and-free-roblox-for-kids-free_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/rbx-tools-earn-free-robux_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/roblox-auto-aim-hack_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/minecraft-free-no-download_GM479516143.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/blox-fish-free-robux_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/download-roblox-windows-7-free_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/free-coins-for-coin-master_GM406889139.pdf
    • https://www.racoh.edu.gh/wp-content/uploads/fsqm-files/hacks-para-roblox-inparcheable-2021_GM431946152.pdf
    • https://www.racoh.edu.gh/wp-content/upl
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005451.bin
b26fbb32fe9744181defb318539f90760c784ca4bb2de7b03692dd40ea7d0242		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5451 25368 bytes
font_01_sfnt_off00008d80.bin
d66e233ace57a73001a73d5d18d9a14415c4818de2adba3ff0ae2b10635dd3d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D80 19172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.