PDF malware analysis — malicious · 4a5f5366192273a1

MALICIOUS

PDF

46.1 KB Created: 2021-05-16 07:21:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: dd4e89f90dd4e4b560c173c05877792c SHA-1: ae680d208394e21c4bf1cbbbb377598edaefbb92 SHA-256: 4a5f5366192273a1cb523ad65860bf7dfa55ccfba4a72b972a3f513ea7bf64e2

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document employs a fake CAPTCHA lure to trick users into clicking embedded URLs, such as 'https://netcdn.xyz/app/431946152/roblox-free-clothes-girl-game-hack'. The document's content and embedded URLs suggest a phishing attempt aimed at distributing malware disguised as game-related downloads or cheats. The ML classifier also flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9432

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/roblox-free-clothes-girl-game-hack
- http://greasley.website/images/free-robux-generator-2021-no-human-verification-or-survey_GM431946152.pdf
- http://greasley.website/images/minecraft-free-download-android-apk_GM479516143.pdf
- http://greasley.website/images/minecraft-apk-114_GM479516143.pdf
- http://greasley.website/images/earn-robux-com_GM431946152.pdf
- http://greasley.website/images/coin-master-links-that-don-t-expire_GM406889139.pdf
- http://greasley.website/images/free-coins-coin-master-link_GM406889139.pdf
- http://greasley.website/images/coin-master-free-gifts_GM406889139.pdf
- http://greasley.website/images/minecraft-pe-apk-download-free-015-0_GM479516143.pdf
- http://greasley.website/images/free-roblox-outfits_GM431946152.pdf
- http://greasley.website/images/play-full-version-of-minecraft-for-free-no-download_GM479516143.pdf
- http://greasley.website/images/free-spins-coin-master-haktuts_GM406889139.pdf
- http://greasley.website/images/coin-master-hack-apk-download-latest-version_GM406889139.pdf
- http://greasley.website/images/roblox-free-items-2021_GM431946152.pdf
- http://greasley.website/images/coin-master-hacks-xyz_GM406889139.pdf
- http://greasley.website/images/roblox-com-free-robux_GM431946152.pdf
- http://greasley.website/images/coin-master-hack-free-spins_GM406889139.pdf
- http://greasley.website/images/coin-master-hack-spin-generator-tool_GM406889139.pdf
- http://greasley.website/images/free-robux-codes-generator-no-verification_GM431946152.pdf
- http://greasley.website/images/ro-ghoul-script_GM431946152.pdf
- http://greasley.website/images/coin-master-fan-page-free-spins_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004a3e.bin` `516fdafa2bd396515813dd71477b534a88ff83df9acb33f40e97590f01497e7e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4A3E	25232 bytes
`font_01_sfnt_off000084cc.bin` `40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x84CC	3884 bytes
`font_02_sfnt_off00009173.bin` `43b97e088e2ffab0722e8ce3b94223e5cd299235dccb62a3edb2f682d17634b7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9173	18340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.