Malicious PDF — malware analysis report

Static analysis result for SHA-256 61a50a93ae7e6d31…

MALICIOUS

PDF

35.2 KB Created: 2021-05-23 12:43:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 1e7dc88680f9c754748172c074209bdb SHA-1: bddcf38d974aef59b149f8e4f5adc88163bbb944 SHA-256: 61a50a93ae7e6d3176a0541dae76553a64908e652e8295e058e123764c575506
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document displays a fake CAPTCHA and includes multiple links, one of which is associated with a malicious ML classifier firing. The document body contains text related to free Robux and a call to action to click a link, suggesting a lure for users to download a payload. The presence of embedded URLs and the fake CAPTCHA heuristic strongly indicate a malicious intent to trick the user into executing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9492

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/rblx-gg-free-robux-game-hack
    • http://joegibara.com.au/images/coin-master-admin-free-spins_GM406889139.pdf
    • http://joegibara.com.au/images/free-spins-and-coins-for-coin-master_GM406889139.pdf
    • http://joegibara.com.au/images/free-robux-websites-that-actually-work_GM431946152.pdf
    • http://joegibara.com.au/images/wurst-client-download_GM479516143.pdf
    • http://joegibara.com.au/images/coin-master-heaven-free-spins-today_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00002f0f.bin
5f370781a067507b96d918c78586f37773abd7e991990df66e24a012af96843b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2F0F 24616 bytes
font_01_sfnt_off000067d8.bin
79d8ff6bb54f2bd25fce5899da6b269aa8d0d1da5a030d2c5dfc49c812010b5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67D8 18376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.