Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d0bbadebda9ad80…

MALICIOUS

PDF

226.0 KB Created: 2021-07-06 07:43:31 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 40d8d5ebfcaf197775cf9d76d7f99257 SHA-1: edf29915cd0ff6c0cad5bd6e19b7343de5a9c534 SHA-256: 2d0bbadebda9ad801d0927b29165d92e0c4435104a1d3126f05b6d55cf815fb4
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file presents itself as a free game download, but employs social engineering tactics such as a fake CAPTCHA and a browser extension installation lure to trick the user into downloading a malicious payload. The embedded URL points to a suspicious domain associated with game hacks and free downloads, further indicating a malicious intent to distribute malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0117

Heuristics 6

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/1094591345/pokemon-go-free-game-game-hack
    • https://digilib.stimlog.ac.id/repository/by-roblox-for-free_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/coin-master-cheat-apk-free-download_GM406889139.pdf
    • https://digilib.stimlog.ac.id/repository/free-roblox-hats3_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/free-robux-codes-generator-2021-july_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/abs-shirt-roblox-free_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/hacker-vs-admin-roblox_GM431946152.pdf
    • http://digilib.stimlog.ac.id/repository/how-do-you-get-free-robux-on-roblox_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-free-robux-no-human-verification_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/my-roblox-account-has-been-hacked-and-changed-my-email_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/how-to-get-free-robux-onroblox-and-pastebin_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-robux-hack-download-pc-2021_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-the-pizzeria-rp-remastered-give-all-coins-hack-2021_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/coin-master-free-spins-link-no-verification-2021_GM406889139.pdf
    • https://digilib.stimlog.ac.id/repository/free-roblox-gift-card-codes-2021-unused_GM431946152.pdf
    • http://digilib.stimlog.ac.id/repository/coin-master-hack-no-human-verification_GM406889139.pdf
    • https://digilib.stimlog.ac.id/repository/promo-codes-to-get-free-robux_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/robux-hack-text-verifacaton_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-robuxfor-free_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-wall-hacks_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-hack-ios-app_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_023_off00031d4a.bin
3a968acfa99fa87f9335b5d11a74a0f5ba51fa37b1b9aabc52608b80775081b0		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x31D4A 25576 bytes
font_01_sfnt_off00035950.bin
92ac6ad3a0b958f298a7cb140fdcde4f079912748741e3bde8383a31f8ed3a1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35950 18360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.