Malicious PDF — malware analysis report

Static analysis result for SHA-256 405a0f6bb0401a7b…

MALICIOUS

PDF

34.4 KB Created: 2021-07-09 05:01:40 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 09b2e8ca9bbd00de330ea55a84d41192 SHA-1: 8600f9d80be4efc9b89c2acce2b22083cd614dc6 SHA-256: 405a0f6bb0401a7b06e165328f4d5f63e008e6c54d104d9dd98753ae973134c0
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a fake CAPTCHA or human verification prompt to trick users into downloading a payload from the embedded URL http://netcdn.tw/app/431946152/free-group-roblox-game-hack. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous game-related lures suggests a social engineering attempt to distribute malware. No scripts were extracted from this sample, but the embedded URLs and fake CAPTCHA heuristic indicate a malicious intent to redirect users to a download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-group-roblox-game-hack
    • https://digilib.stimlog.ac.id/repository/free-bc-tbc-obc-and-robux_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-hack-week-custom-materials_GM431946152.pdf
    • http://digilib.stimlog.ac.id/repository/free-robux-games-on-roblox-that-work_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/free-spins-coin-master-cheat_GM406889139.pdf
    • https://digilib.stimlog.ac.id/repository/white-pants-roblox-free_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/hack-for-rpg-world-on-roblox-to-get-money_GM431946152.pdf
    • http://digilib.stimlog.ac.id/repository/roblox-hack-copy-and-paste_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/ban-hack-for-roblox_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/minecraft-apk-android-free_GM479516143.pdf
    • https://digilib.stimlog.ac.id/repository/roblox-cheats-invincibility_GM431946152.pdf
    • http://digilib.stimlog.ac.id/repository/hack-coin-master-apk-31_GM406889139.pdf
    • http://digilib.stimlog.ac.id/repository/free-robux-just-enter-username_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/free-minecraft-account-generator_GM479516143.pdf
    • http://digilib.stimlog.ac.id/repository/coin-master-heaven-free-spins_GM406889139.pdf
    • https://digilib.stimlog.ac.id/repository/free-roblox-hair-codes_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/how-to-get-your-hacked-acc-back-roblox_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/nuevo-hack-de-robux-2021_GM431946152.pdf
    • https://digilib.stimlog.ac.id/repository/free-robux-generator-for-roblox-2021_GM431946152.pdf
    • http://digilib.stimlog.ac.id/repository/when-was-minecraft-free_GM479516143.pdf
    • https://digilib.stimlog.ac.id/repository/cute-free-hairs-for-girls-in-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fb3.bin
1f15d582b1456e9aa554afe123c271f31b87d364f79e77e1ed3a396bdb545fec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FB3 22392 bytes
font_01_sfnt_off000061c0.bin
57604ea57d62e2aa634e965ec5800ebb3da15d6ae68f920e4611ad7eaaeb6114		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61C0 18968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.