PDF malware analysis — malicious · 53ed1ba712fbf386

MALICIOUS

PDF

46.2 KB Created: 2021-05-19 12:56:27 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 1e9cc23190f594b74b690bd5816f5ae8 SHA-1: dfca053af6490929a88c471b3ddb5d6258ac4a03 SHA-256: 53ed1ba712fbf3866618c5d5fe305e76076cc6fb414068a75b63ed5e38b972f9

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents a fake CAPTCHA to trick the user into interacting with it, a common social engineering tactic. It contains an embedded URI pointing to a suspicious URL, likely intended to download a second-stage payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9432

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/robux-hack-2021-game-hack
- http://stomatolog-choszczno.pl/images/coin-master-app_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/how-to-get-free-robux-no-human-verification-2021_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/free-roblox-exploits_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/coin-master-33-hack-version-download_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/get-free-robux-today_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/coin-master-free-coins-and-spins-daily_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/coin-master-hack-app-ios_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/make-free-robux_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/how-to-get-free-robux-gift-cards_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/coin-master-free-spins-and-coins-app_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/coin-master-hack-2021_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/minecraft-free-download-iphone_GM479516143.pdf
- http://stomatolog-choszczno.pl/images/coin-master-daily-free-spins-hack_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/minecraft-windows-10-hacks_GM479516143.pdf
- http://stomatolog-choszczno.pl/images/free-robux-codes-no-verification-2021_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/coin-master-free-daily-spins_GM406889139.pdf
- http://stomatolog-choszczno.pl/images/free-robux-for-free_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/how-to-get-free-robux-2021_GM431946152.pdf
- http://stomatolog-choszczno.pl/images/how-to-make-a-free-server-in-minecraft-java_GM479516143.pdf
- http://stomatolog-choszczno.pl/images/minecraft-bedrock-edition-download-pc-free_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000481c.bin` `3c4b1b55808145f7cef70d8a98776ee50fdabd74f7b3882db612e80167f940e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x481C	26568 bytes
`font_01_sfnt_off000083b0.bin` `450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x83B0	5696 bytes
`font_02_sfnt_off000090c2.bin` `960613bb0fa4c19a2503237e067522a4d484b1b5f3e7387dbdf2c2d9282ca05f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x90C2	18648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.