PDF malware analysis — malicious · 5ce5ff7dcb7c8bc8

MALICIOUS

PDF

44.6 KB Created: 2021-06-09 05:41:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 8149adfc017cc524bdb6a92e0a325aae SHA-1: 2d70707cdfd4b7282a808ca610116b7ca269a110 SHA-256: 5ce5ff7dcb7c8bc8ca9b4658c375462600edbf0fe90fd7aeb0dabd597f704071

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents itself as a guide to game hacks, but contains a fake CAPTCHA lure to trick users into downloading further malicious content. The embedded URLs point to suspicious domains, likely hosting the second-stage payload. No scripts were extracted, but the overall structure and heuristics indicate a social engineering attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9865

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/how-to-reach-hacks-in-sf-roblox-game-hack
- http://repository.ummy.ac.id//repository/roblox-hack-download_GM431946152.pdf
- http://repository.ummy.ac.id//repository/pokemon-go-free-egg-incubator_GM1094591345.pdf
- http://repository.ummy.ac.id//repository/roblox-promo-codes-free-robux_GM431946152.pdf
- http://repository.ummy.ac.id/repository/free-followers-on-roblox-no-verification_GM431946152.pdf
- http://repository.ummy.ac.id//repository/can-you-get-robux-for-free_GM431946152.pdf
- http://repository.ummy.ac.id/repository/cheat-roblox-pet-simulator_GM431946152.pdf
- http://repository.ummy.ac.id//repository/free-robux-without-human-verification-2021_GM431946152.pdf
- http://repository.ummy.ac.id//repository/free-2021-robux_GM431946152.pdf
- http://repository.ummy.ac.id//repository/coin-master-free-spin-whatsapp-group-link_GM406889139.pdf
- http://repository.ummy.ac.id//repository/free-robux-no-verification-at-all_GM431946152.pdf
- http://repository.ummy.ac.id//repository/coin-master-new-link-free-spin_GM406889139.pdf
- http://repository.ummy.ac.id//repository/roblox-com-free-robux_GM431946152.pdf
- http://repository.ummy.ac.id//repository/how-to-get-free-robux-2021_GM431946152.pdf
- http://repository.ummy.ac.id//repository/games-to-get-free-robux_GM431946152.pdf
- http://repository.ummy.ac.id//repository/free-robux-generator-codes_GM431946152.pdf
- http://repository.ummy.ac.id//repository/daily-spin-coin-master-free_GM406889139.pdf
- http://repository.ummy.ac.id//repository/can-u-get-free-robux_GM431946152.pdf
- http://repository.ummy.ac.id//repository/hack-minecraft_GM479516143.pdf
- http://repository.ummy.ac.id//repository/free-spin-coin-master-link-2021_GM406889139.pdf
- http://repository.ummy.ac.id//repository/how-to-add-mods-to-minecraft-pe_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005089.bin` `f4465765549c330ca7c5cb0c7a5b471112033d1c7a60e5912db2505b38367a4e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5089	25364 bytes
`font_01_sfnt_off00008af1.bin` `2993c6985471238efa2e3b122f01c75f90717ea4993c9890b742c87fda94cfed`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8AF1	18512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.