PDF malware analysis — malicious · 5ddf352063db9e90

MALICIOUS

PDF

52.4 KB Created: 2021-05-12 23:03:22 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 610ef6e7fb984342facf8ed1ddbf8bb6 SHA-1: ea290414112e19e5cd6c34adea8daba15dbfcd25 SHA-256: 5ddf352063db9e900e3b2a998460be116e4b24e6f0b26b206ab8f467e59bcb21

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure for 'free Robux' and displays a fake CAPTCHA to trick the user into clicking a malicious link. The embedded URL, https://netcdn.xyz/app/431946152/free-robux-just-click-game-hack, likely leads to a further stage of infection or phishing. The ML classifier also flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.8646

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-robux-just-click-game-hack
- https://www.guterdj.de/images/coin-master-hack-app-2021-download_GM406889139.pdf
- https://www.guterdj.de/images/my-robux_GM431946152.pdf
- https://www.guterdj.de/images/free-premium-roblox_GM431946152.pdf
- https://www.guterdj.de/images/how-to-hack-peoples-roblox-accounts_GM431946152.pdf
- https://www.guterdj.de/images/free-robux-please_GM431946152.pdf
- https://www.guterdj.de/images/master-coin-free-link_GM406889139.pdf
- https://www.guterdj.de/images/minecraft-java-hacks_GM479516143.pdf
- https://www.guterdj.de/images/free-pet-food-coin-master_GM406889139.pdf
- https://www.guterdj.de/images/roblox-hacks-2021_GM431946152.pdf
- https://www.guterdj.de/images/coin-master-hack-tool-without-verification_GM406889139.pdf
- https://www.guterdj.de/images/can-you-play-minecraft-for-free_GM479516143.pdf
- https://www.guterdj.de/images/roblox-free-exploits_GM431946152.pdf
- https://www.guterdj.de/images/coin-master-hack-unlimited-spins-apk-download_GM406889139.pdf
- https://www.guterdj.de/images/free-robux-now_GM431946152.pdf
- https://www.guterdj.de/images/easy-way-to-get-free-robux_GM431946152.pdf
- https://www.guterdj.de/images/links-to-get-free-coins-in-coin-master_GM406889139.pdf
- https://www.guterdj.de/images/robux-withdraw_GM431946152.pdf
- https://www.guterdj.de/images/how-to-get-minecraft-windows-10-edition-for-free_GM479516143.pdf
- https://www.guterdj.de/images/coin-master-tricks_GM406889139.pdf
- https://www.guterdj.de/images/claimrbx-free-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004c69.bin` `1594c5bd9b1cd31694159be57910f8361f606220597fd3a02a9482dfe2942356`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4C69	27588 bytes
`font_01_sfnt_off00008e1e.bin` `2fcd338afa38ce4e165bdd46d8d135c416430556e571811a0ba8a6f2402b0f30`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8E1E	4736 bytes
`font_02_sfnt_off00009d88.bin` `e59bc53cd4c0ee65dc1533becad2866f345dcb060e6c68bb8187d21cb9f973ee`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9D88	3396 bytes
`font_03_sfnt_off0000a97a.bin` `e1ded540cd05842e87825decc4eb8ad0d20e53c32addf12c669dcda9e984b3fb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA97A	18648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.