Malicious PDF — malware analysis report

Static analysis result for SHA-256 540e5caa8c285e6d…

MALICIOUS

PDF

33.8 KB Created: 2021-07-09 16:58:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: ae185570dccea9dc1ed7fba0cd7e952f SHA-1: bf8c61ffd212427cd722954422d28324cf5cb83e SHA-256: 540e5caa8c285e6d7169b6a1fc80153ad576fc5106b4bc1d5323de6211297485
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA lure, a common social engineering tactic to trick users into interacting with malicious content. It also embeds a URL that likely leads to a second-stage payload download. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/minecraft-fly-hack-game-hack
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/free-robux-hack-no-verification_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/roblox-hack-2021-robux-no-survey_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/roblox-skins-free-download-girl_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/bear-cheats-roblox_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/free-robux-lebansay-group_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/roblox-apocalypse-rising-cheats_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/dont-tell-anyone-about-this-free-robux-glitch-july-2021_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/free-robux-with-no-verification-2021_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-codes-2021_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/hacks-for-roblox-phantom-forces-2021_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/free-roblox-gameplay_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/funbloxxyz-free-robux_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/how-to-open-cheat-engine-without-roblox-shutting-down_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/coin-master-free-coins-twitter_GM406889139.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/free-robux-discord-servers_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/how-do-people-hack-roblox-accounts-reddit_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-real_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/free-spin-coin-master-link-2021_GM406889139.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/free-robux-generator-no-human-verification-2021_GM431946152.pdf
    • https://elearning.man1kotakediri.sch.id/__statics/gudangsoal/files/robuxfree-con_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000317a.bin
4954de8fec43eef5b2fb77724314846062ce34e4e200cc263aa70ce6dd218485		 pdf-font-stream PDF embedded font (sfnt) at offset 0x317A 21908 bytes
font_01_sfnt_off000061ac.bin
56f87322d6175f5188b2f3e54b3290a6e5898c7bed8f3d8c577e55e984b17e01		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61AC 18280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.