Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f9a99c7e0093a14…

MALICIOUS

PDF

46.3 KB Created: 2021-05-14 13:15:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 3b8c3cde81af87b84c67e533f61b24b8 SHA-1: ee465058fab3e8d79a8d94baca065e93c2176512 SHA-256: 3f9a99c7e0093a14ca8784c7a3a846413f2634fd7fee7060ecd8ea536005e5b3
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document presents a fake CAPTCHA or human verification prompt to trick the user into interacting with it, likely to initiate a download from the embedded URL. The ML classifier also flagged this PDF as malicious. The presence of multiple URLs suggests an attempt to distribute further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8696

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-generator-game-hack
    • http://lv-siegen.de/images/free-minecraft-gift-codes_GM479516143.pdf
    • http://lv-siegen.de/images/how-can-i-get-free-robux_GM431946152.pdf
    • http://lv-siegen.de/images/how-to-get-more-robux-for-free_GM431946152.pdf
    • http://lv-siegen.de/images/robux-free-gift-card_GM431946152.pdf
    • http://lv-siegen.de/images/hack-coin-master-apk-31_GM406889139.pdf
    • http://lv-siegen.de/images/minecraft-aimbot_GM479516143.pdf
    • http://lv-siegen.de/images/buxblast-com-robux_GM431946152.pdf
    • http://lv-siegen.de/images/free-robux-no-survey_GM431946152.pdf
    • http://lv-siegen.de/images/minecraft-free-no-download_GM479516143.pdf
    • http://lv-siegen.de/images/rewardrobux-com_GM431946152.pdf
    • http://lv-siegen.de/images/robux-hack-generator_GM431946152.pdf
    • http://lv-siegen.de/images/mcpe-master-hack-coin-apk_GM406889139.pdf
    • http://lv-siegen.de/images/coin-master-free-gold-cards-link-2021ee-spins_GM406889139.pdf
    • http://lv-siegen.de/images/coin-master-hack-apk-with-fb-login-2021_GM406889139.pdf
    • http://lv-siegen.de/images/coin-master-spin-hack-link_GM406889139.pdf
    • http://lv-siegen.de/images/hack-coin-master-apk-32-download_GM406889139.pdf
    • http://lv-siegen.de/images/free-roblox-gfx_GM431946152.pdf
    • http://lv-siegen.de/images/www-coinmaster-com_GM406889139.pdf
    • http://lv-siegen.de/images/free-roblox-accounts-with-robux-2021_GM431946152.pdf
    • http://lv-siegen.de/images/coin-master-gifts_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004749.bin
8a9a19eaeb210d3931bfe5166c04d238520fa196112a67cd3e4cafeb8957a732		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4749 26836 bytes
font_01_sfnt_off000085b3.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85B3 5696 bytes
font_02_sfnt_off000092c5.bin
6ad13131c8a801fdee9b2b1f688ac66371065e9680419547ef4f25df18f73033		 pdf-font-stream PDF embedded font (sfnt) at offset 0x92C5 18184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.