Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a2914f022bd1c8a…

MALICIOUS

PDF

45.9 KB Created: 2021-06-11 06:49:50 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: d0928db4c35e30c42e088d0e25169265 SHA-1: d610c443f2b280f4049c50edd9a99e4b86c32b20 SHA-256: 6a2914f022bd1c8a83d16f567679a0d82cd76764b65d0b56357a6213fd75ae39
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA lure, indicating an attempt to trick the user into interacting with the document. It also embeds multiple URLs, one of which is directly associated with a malicious heuristic, suggesting the document's purpose is to redirect users to potentially harmful content or downloads. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/assassin-2-roblox-hack-khnif-game-hack
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/minecraft-free-install_GM479516143.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/get-free-robux-no-human-verification_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-roblox-accounts-2021_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/roblox-ro-ghoul-how-to-get-a-different-for-free_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/roblox-free-robux-es_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/coin-master-free-spins-link_GM406889139.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-no-human-verification-2021_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/how-to-hack-bc-on-roblox-2021_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/games-that-give-you-free-robux_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-robux-gift-card_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/how-to-get-minecraft-for-free-on-phone_GM479516143.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/roblox-free-audio_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-robux-scams_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-minecraft-worlds_GM479516143.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-robux-hacker-us_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/robux-hack-no-verification-no-survey-no-download_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-tiktok-likes-no-human-verification-or-downloading-apps_GM835599320.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/robux-free-com_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/tutorial-avanzado-de-cheat-engine-para-dragon-ball-rage-roblox_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-100-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005365.bin
39746198873943fa01b93be4dc22c36ca97d7a6f4dda3899b120e5fdf13f3516		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5365 26760 bytes
font_01_sfnt_off0000901b.bin
1042e22df7025e44cc7c10c18dae86a936e09c1fd436f05d19fbc6df7ac4d071		 pdf-font-stream PDF embedded font (sfnt) at offset 0x901B 18592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.