PDF malware analysis — malicious · 66993563d141bd7a

MALICIOUS

PDF

45.6 KB Created: 2021-05-18 04:08:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 2c5243d427dd58daf9c30deaaaf79bab SHA-1: 7bc6526125118bfe18ed96ba215b4083bce3e339 SHA-256: 66993563d141bd7a77df259f328f162c5068032d67f8a3dbc2dc1fb9970c483c

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains a fake CAPTCHA lure, designed to trick users into interacting with the document. It also embeds external URIs pointing to potentially malicious content, such as 'https://netcdn.xyz/app/431946152/robux-earning-sites-game-hack'. The presence of these elements strongly suggests an attempt to deliver a second-stage payload or redirect the user to a phishing site.

Machine Learning

Nyx PDF Classifier malicious score 0.9507

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/robux-earning-sites-game-hack
- https://www.tsdb.com.au/images/coin-master-hack-programers_GM406889139.pdf
- https://www.tsdb.com.au/images/free-robux-please_GM431946152.pdf
- https://www.tsdb.com.au/images/coin-master-free-spins-link-2021-app_GM406889139.pdf
- https://www.tsdb.com.au/images/install-free-game-coin-master_GM406889139.pdf
- https://www.tsdb.com.au/images/how-to-hack-and-get-free-robux_GM431946152.pdf
- https://www.tsdb.com.au/images/how-to-get-free-pet-food-in-coin-master_GM406889139.pdf
- https://www.tsdb.com.au/images/robux-hacks-2021_GM431946152.pdf
- https://www.tsdb.com.au/images/coin-master-hack-spins-2021_GM406889139.pdf
- https://www.tsdb.com.au/images/how-to-get-free-admin-in-roblox_GM431946152.pdf
- https://www.tsdb.com.au/images/free-minecraft-severs_GM479516143.pdf
- https://www.tsdb.com.au/images/coin-master-daily-gift-free-spins-and-coins_GM406889139.pdf
- https://www.tsdb.com.au/images/how-to-get-free-robux-for-free_GM431946152.pdf
- https://www.tsdb.com.au/images/coin-master-free-100-spin_GM406889139.pdf
- https://www.tsdb.com.au/images/free-robux-microsoft_GM431946152.pdf
- https://www.tsdb.com.au/images/coin-master-gold-cards-hack_GM406889139.pdf
- https://www.tsdb.com.au/images/can-you-actually-get-free-robux_GM431946152.pdf
- https://www.tsdb.com.au/images/coin-master-hack-mobile_GM406889139.pdf
- https://www.tsdb.com.au/images/minecraft-free-download-android_GM479516143.pdf
- https://www.tsdb.com.au/images/coin-master-hack-with-facebook-login_GM406889139.pdf
- https://www.tsdb.com.au/images/coin-master-get-free-spins_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000044a1.bin` `6346606343c733d02c467f1f46ead94ec313be802f26d851eb157cb6454732ad`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x44A1	25100 bytes
`font_01_sfnt_off00007e86.bin` `ae114634718854704d615808d33fb1b747d90eb28e420080bd5adbdfe7fb6a27`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7E86	6700 bytes
`font_02_sfnt_off00008ec4.bin` `86c9cbabc58c05dcca32ff3967a8cba2f2ca88b13f48cfcd06e4bbeea785338f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8EC4	18592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.