Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e81bcb2b8189b6b…

MALICIOUS

PDF

45.1 KB Created: 2021-06-11 06:58:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: ab87815cc2d9b0deb31bccf0335022a0 SHA-1: 82927dcb0a4f0d191da032c69a74dbc7ff34398d SHA-256: 5e81bcb2b8189b6b4694df36db18f72006be9eb64bc5e8b789f4279ac10c2c1d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The document presents a fake CAPTCHA lure to trick users into downloading potentially malicious content, as indicated by the 'SE_FAKE_CAPTCHA' heuristic. The embedded URL 'https://netcdn.tw/app/431946152/roblox-skywars-hack-game-hack' likely serves as the download location for a second-stage payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 5

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-skywars-hack-game-hack
    • http://perpus.poltekeskupang.ac.id//repository/roblox-points_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id//repository/free-coin-master-hacks-no-verification_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/free-bling-bling-card-coin-master_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/hack-struicid-stop-start-roblox_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id//repository/coin-master-hack-co_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/what-is-coin-master_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/como-hackear-coin-master-iphone_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id//repository/coin-master-hack-link_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/will-minecraft-dungeons-be-free_GM479516143.pdf
    • http://perpus.poltekeskupang.ac.id/repository/how-to-get-free-pet-snacks-in-coin-master_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/optifine-pe_GM479516143.pdf
    • http://perpus.poltekeskupang.ac.id//repository/how-to-watch-ads-for-free-spins-in-coin-master_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/roblox-exploit-scripts_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id/repository/coin-master-hack-apk-download-for-android-mobile_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id//repository/freerobuxhack-us-2021_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id/repository/coin-master-stop-attack-hack_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id//repository/get-free-minecraft-account_GM479516143.pdf
    • http://perpus.poltekeskupang.ac.id/repository/how-to-become-a-roblox-admin-hack_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id/repository/cheat-roblox-csgo-november-2021_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id//repository/how-to-get-100-robux-for-free_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004fd8.bin
682734a233b74f245a8177d1288a327d731ac2f6d97be2c7def32457ebceba33		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4FD8 26968 bytes
font_01_sfnt_off00008cc3.bin
355616d0e5121cb439e34c8e8faf224614bf0d031e9e3f473de434f948d3b6c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CC3 18528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.