PDF malware analysis — malicious · 56fbcb5ae3384861

MALICIOUS

PDF

41.4 KB Created: 2021-05-14 12:34:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 9993e9b957f67d538f1ed460a13f620d SHA-1: edd6635ec689ae037d24a86c0e4f288b69b7055b SHA-256: 56fbcb5ae33848612b7802be0b185a9b2ee48e9ba80a18fa6863b2bc0ebc035f

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF document contains a fake CAPTCHA lure and visual download buttons, aiming to trick the user into downloading applications. It references popular games like Coin Master and Roblox, with embedded URLs pointing to download sites. The ML classifier strongly indicates maliciousness, supporting the observed social engineering tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-game-free-download-game-hack
- https://www.bumbar-sport.hr/files/coin-master-tiradas-gratis-2021_GM406889139.pdf
- https://www.bumbar-sport.hr/files/roblox-hack-app_GM431946152.pdf
- https://www.bumbar-sport.hr/files/free-coins-and-spins-coin-master_GM406889139.pdf
- https://www.bumbar-sport.hr/files/coin-master-hack-2021-no-survey_GM406889139.pdf
- https://www.bumbar-sport.hr/files/minecraft-life-hacks_GM479516143.pdf
- https://www.bumbar-sport.hr/files/roblox-pink-free-robux_GM431946152.pdf
- https://www.bumbar-sport.hr/files/free-spins-and-coins-for-coin-master_GM406889139.pdf
- https://www.bumbar-sport.hr/files/open-coin-master_GM406889139.pdf
- https://www.bumbar-sport.hr/files/get-free-robux-no-human-verification_GM431946152.pdf
- https://www.bumbar-sport.hr/files/download-coin-master-hack-tool-v1-9_GM406889139.pdf
- https://www.bumbar-sport.hr/files/mcpe-master-hack-unlimited-coins_GM406889139.pdf
- https://www.bumbar-sport.hr/files/how-to-earn-robux-for-free-2021_GM431946152.pdf
- https://www.bumbar-sport.hr/files/coin-master-hack-android-root_GM406889139.pdf
- https://www.bumbar-sport.hr/files/free-robux-quiz_GM431946152.pdf
- https://www.bumbar-sport.hr/files/free-coins-for-coin-master_GM406889139.pdf
- https://www.bumbar-sport.hr/files/robux-com-free-robux_GM431946152.pdf
- https://www.bumbar-sport.hr/files/earn-robux-for-roblox_GM431946152.pdf
- https://www.bumbar-sport.hr/files/how-to-hack-people-in-roblox_GM431946152.pdf
- https://www.bumbar-sport.hr/files/game-hunters-coin-master-free-spins_GM406889139.pdf
- https://www.bumbar-sport.hr/files/free-spins-coin-master-links-blogspot_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000047b5.bin` `fe044bb61c9909b00b9454c9b4f03bb9b9cb828c34ad12ec8e78d46ae4045e7a`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47B5	24412 bytes
`font_01_sfnt_off00007ec4.bin` `a0a0c8e1d18cb0b2c4d70870d3dfc55de425b9372d4c2a3baebf4bcbef941d80`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7EC4	18548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.