PDF malware analysis — malicious · 52c7158a61846b4c

MALICIOUS

PDF

45.9 KB Created: 2021-05-11 17:05:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 48193dad97728e8227c607d968d26cb8 SHA-1: a087fa0e21e88abbc21c5502cac7ad0365981db9 SHA-256: 52c7158a61846b4c476f8f9efc76bee260ba8c3aef11cfd2aa3a2e64fe16c602

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs a fake CAPTCHA lure to deceive users into clicking embedded malicious links. The primary link, https://netcdn.xyz/app/479516143/minecraft-ps3-free-download-game-hack, suggests a download for game-related content, likely a malicious payload. The document's structure and embedded links indicate an attempt to trick users into executing further malicious content, possibly through a drive-by download or a social engineering pretext.

Machine Learning

Nyx PDF Classifier malicious score 0.9432

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/minecraft-ps3-free-download-game-hack
- http://magnipsor.su/images/roblox-army-robux_GM431946152.pdf
- http://magnipsor.su/images/get-gold-coin-master-village-hack_GM406889139.pdf
- http://magnipsor.su/images/free-ways-to-get-robux_GM431946152.pdf
- http://magnipsor.su/images/get-free-robux-2021_GM431946152.pdf
- http://magnipsor.su/images/how-to-get-free-things-on-roblox_GM431946152.pdf
- http://magnipsor.su/images/free-roblox-animations_GM431946152.pdf
- http://magnipsor.su/images/coin-master-free-spins-link-2021_GM406889139.pdf
- http://magnipsor.su/images/coin-master-free-spins-hack-but-no-surveys_GM406889139.pdf
- http://magnipsor.su/images/coin-master-free-cards-link_GM406889139.pdf
- http://magnipsor.su/images/free-robux-hack-us_GM431946152.pdf
- http://magnipsor.su/images/all-links-for-free-spins-coin-master_GM406889139.pdf
- http://magnipsor.su/images/free-robux-for-free_GM431946152.pdf
- http://magnipsor.su/images/coin-master-game-hunters-club_GM406889139.pdf
- http://magnipsor.su/images/coin-master-hack-without-verification-2021_GM406889139.pdf
- http://magnipsor.su/images/best-free-robux-sites_GM431946152.pdf
- http://magnipsor.su/images/free-spins-for-coin-master_GM406889139.pdf
- http://magnipsor.su/images/daily-free-spins-on-coin-master_GM406889139.pdf
- http://magnipsor.su/images/how-to-get-free-spins-for-coin-master_GM406889139.pdf
- http://magnipsor.su/images/minecraft-bedrock-edition-free-with-java_GM479516143.pdf
- http://magnipsor.su/images/coin-master-free-spins-link-today-ios_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004d40.bin` `02dae705dbaddfd4209f1da794b5cd0f47bd73bd74852105bbcdccc803e0d345`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4D40	25060 bytes
`font_01_sfnt_off0000862f.bin` `29ffac6ae2c225ad742d302df2deaca7764d0abb58a6f2c81d3137a4f416ba07`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x862F	2880 bytes
`font_02_sfnt_off0000901d.bin` `443c579721cb83aa688c87d53d4f821f8ee4cd96576bd26e49b571574689098a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x901D	18620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.