Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c8bf13a8554aaa4…

MALICIOUS

PDF

45.0 KB Created: 2021-05-10 23:49:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 9f8ff7ca907cb167f01ec0a60925b185 SHA-1: 6b1ecef536bc1b34e4b0bc76fa49a142ccf20ca5 SHA-256: 2c8bf13a8554aaa445c311a8f4badb646f899d335e705aa08348099277db7196
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document exhibits characteristics of a phishing or scam attempt, using a fake CAPTCHA and promising game-related currency (Robux) to lure users. It contains numerous embedded URLs pointing to external sites, likely serving as landing pages for further exploitation or malware delivery. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-generators-that-actually-work-game-hack PDF link annotation
    • http://sportagon.be/images/roblox-bux-free_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/robux-game_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/free-coin-master-spins-link-facebook_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/is-it-possible-to-hack-coin-master_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/lazy-blocks-com-free-robux_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/free-games-coin-master_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/roblox-free-hair-boy_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/free-spins-coin-master-blogspot_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/how-to-hack-robux_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/free-coin-spin-daily-link-net_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/coin-master-extra-spins_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/free-robux-offers_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/legit-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/free-robux-generator_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/how-to-get-free-robux-com_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/get-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/how-to-get-free-robux-without-downloading-any-apps_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/games-on-roblox-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://sportagon.be/images/free-spins-coins-coin-master_GM406889139.pdfIn PDF document text
    • http://sportagon.be/images/coin-master-daily-free-link_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004954.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4954 29132 bytes
SHA-256: 49fe17d2ba78fc40dbaa84c2209130cd00e2db3e976ed25617c41be519a46160
font_01_sfnt_off00008bb2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8BB2 18968 bytes
SHA-256: ddbdedd946da9c20f240abbed8bdf8c55517508d28d22b252adc9eca822b6901

Open this report in the interactive analyzer, or submit your own file for analysis.