Malicious PDF — malware analysis report

Static analysis result for SHA-256 587d3f69d98f85de…

MALICIOUS

PDF

43.1 KB Created: 2021-06-08 23:04:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c7adca011dc60674b5a09579269bccb9 SHA-1: 3116eea377ed7426d5c62f10747efc60b4c7b6ed SHA-256: 587d3f69d98f85ded98b31deb8b2132b5a6e9f1a370abf297a5faeaabbd1e2f2
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a fake CAPTCHA lure, aiming to trick the user into interacting with the content. It also embeds a URL that likely leads to a malicious download or further compromise. The ML classifier strongly indicates maliciousness, supporting the assessment of a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 5

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/sign-in-to-get-free-robux-game-hack
    • https://perpus.upp.ac.id/digilib/repository/can-i-get-robux-for-free_GM431946152.pdf
    • https://perpus.upp.ac.id/digilib/repository/how-to-get-free-stuff-in-catalog-in-roblox_GM431946152.pdf
    • https://perpus.upp.ac.id/digilib/repository/minecraft-beta-free_GM479516143.pdf
    • https://perpus.upp.ac.id/digilib/repository/can-i-get-free-robux_GM431946152.pdf
    • https://perpus.upp.ac.id/digilib/repository/minecraft-anarchy-server-no-hacks_GM479516143.pdf
    • https://perpus.upp.ac.id/digilib/repository/roblox-piano-keyboard-cheat_GM431946152.pdf
    • https://perpus.upp.ac.id/digilib/repository/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
    • https://perpus.upp.ac.id/digilib/repository/orewards-com-free-robux_GM431946152.pdf
    • https://perpus.upp.ac.id/digilib/repository/mcpe-download_GM479516143.pdf
    • https://perpus.upp.ac.id/digilib/repository/coin-master-hack-no-human-verification_GM406889139.pdf
    • https://perpus.upp.ac.id/digilib/repository/tiktok-free-4k_GM835599320.pdf
    • https://perpus.upp.ac.id/digilib/repository/coin-master-100-spin_GM406889139.pdf
    • https://perpus.upp.ac.id/digilib/repository/coin-master-35-13-hack-download_GM406889139.pdf
    • https://perpus.upp.ac.id/digilib/repository/coin-master-free-spins-and-coins-app_GM406889139.pdf
    • https://perpus.upp.ac.id/digilib/repository/coin-master-free-coins-and-spins-app_GM406889139.pdf
    • https://perpus.upp.ac.id/digilib/repository/minecraft-dungeons-free-download_GM479516143.pdf
    • https://perpus.upp.ac.id/digilib/repository/play-minecraft-online-free_GM479516143.pdf
    • https://perpus.upp.ac.id/digilib/repository/coin-master-free-soins_GM406889139.pdf
    • https://perpus.upp.ac.id/digilib/repository/coin-master-hacks-free-spins_GM406889139.pdf
    • https://perpus.upp.ac.id/digilib/repository/free-robux-working_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004cde.bin
ebb58f2ebb59b08bb8f071e0c224ccb74c508a3fa31ea83f6fbdaa02cbcafd36		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4CDE 24552 bytes
font_01_sfnt_off00008520.bin
5071d4a143e9558397dbf95313b6d7b466d64cf6cc249acc172a11258d42a633		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8520 18528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.