Malicious PDF — malware analysis report

Static analysis result for SHA-256 4950e0bef878fa6f…

MALICIOUS

PDF

49.1 KB Created: 2021-06-08 12:47:45 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 1cd84c6dba6db4d09034dcf7f7308852 SHA-1: b3c52f948e3faf24749d1d26c35be44aaba86224 SHA-256: 4950e0bef878fa6fec260dfafc30d36cd11ed879d10d289ca5ebd7eb614393da
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is a PDF that displays a fake CAPTCHA or human verification prompt, a common lure to trick users into interacting with malicious content. It contains an embedded URI pointing to a URL that likely hosts a payload. The document body, though heavily obfuscated, contains references to game hacks and a URL, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-space-outpost-tycoon-script-hack-2021-game-hack PDF link annotation
    • http://lib.fisipumt.ac.id//repository/coin-master-connection-lost_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-links-to-get-free-spins_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/coin-master-unlimited-spins-hack_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/mcpe-optifine_GM479516143.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/minecraft-auto-miner-hack_GM479516143.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/free-roblox-promo-codes-for-robux_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/blox-pink-robux-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-do-you-get-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/bit-ly-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/hack-coin-master-game-apk_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/real-robux-generator-2021_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/roblox-how-to-get-free-clothes_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-robux-no-download_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/how-to-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/free-coins-for-planet-master-game_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/how-to-get-free-robux-instantly_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/coin-master-free-coins-and-spins-daily_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-400-spin-link_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/coin-master-hack-tool-pc-download_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-mod-apk-latest-hack-with-unlimited-free-spins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000501b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x501B 25948 bytes
SHA-256: 606f4208663b5a3e71ef5e38719a0658b1de7d539bd0ee36efd45dd0b2aff6fe
font_01_sfnt_off00008cc9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8CC9 5696 bytes
SHA-256: 450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139
font_02_sfnt_off000099db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x99DB 19304 bytes
SHA-256: aabe24c0b412bf5a0cd44f693d8c78c2298971109701e64d88af5b0bf0fae611

Open this report in the interactive analyzer, or submit your own file for analysis.