Malicious PDF — malware analysis report

Static analysis result for SHA-256 49118f462ad4e72f…

MALICIOUS

PDF

40.0 KB Created: 2021-05-24 17:01:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: ea6b6e9ad2f3b4d031f9a6ec356052dc SHA-1: c1961ded479d23998335fbc8218b70fe7ed0507d SHA-256: 49118f462ad4e72ffc1017e6a6f234b081b99372157ee8c68f20aae344a4a689
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents itself as a lure for free game hacks or followers, employing a fake CAPTCHA heuristic to trick users into interacting with malicious links. The embedded URLs point to external resources that likely host further malicious content or malware. While no scripts were explicitly extracted, the PDF structure and heuristics suggest an attempt to exploit user interaction for malicious download or execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8308

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/835599320/tiktok-for-free-game-hack
    • http://halle-wasserball.de/images/robux-free-promo-codes_GM431946152.pdf
    • http://halle-wasserball.de/images/how-to-get-free-robux-fast-and-easy_GM431946152.pdf
    • http://halle-wasserball.de/images/minecraft-windows-10-edition-unlock-full-game-free_GM479516143.pdf
    • http://halle-wasserball.de/images/spin-coin-master-free_GM406889139.pdf
    • http://halle-wasserball.de/images/free-tiktok-followers-app_GM835599320.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00002ed4.bin
7fb8d6142797eeab7c6b03e73d00a839bc2fab419bdf9a976bd561320fbc5be7		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2ED4 24672 bytes
font_01_sfnt_off00006672.bin
dfbbf67cbc7ecc66ac4d03805ccfff7e5c1407898ea3c5e2b9241b85217ff1cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6672 3372 bytes
font_02_sfnt_off000071f3.bin
49734f51977507cba6bc8d3ad0cee0363aa119856db094427deb9cf565bb7bca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71F3 3120 bytes
font_03_sfnt_off00007d06.bin
59b82efa7141ba2b07d91e3b641cbf682cee4575ed292f5ecf89ba3b7e2e2e13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D06 17456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.