PDF malware analysis — malicious · 7351a77c47c0030c

MALICIOUS

PDF

52.4 KB Created: 2021-06-08 10:24:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 398ed0b146f6e3fd183662a287222f00 SHA-1: 7e8c1db57c5149c58973bc560757bcc9b1173127 SHA-256: 7351a77c47c0030c883e79514dd8e7c553406c661461f5f3f41758aec2611ad2

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains a fake CAPTCHA lure, a common social engineering technique to trick users into interacting with malicious content. It also embeds multiple URLs, one of which is directly linked to a 'how to hack' theme, suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9657

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/how-to-hack-roblox-with-cookie-editor-game-hack
- https://pa-waingapu.go.id/images/free-robux-hacker-us_GM431946152.pdf
- https://pa-waingapu.go.id/images/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
- https://pa-waingapu.go.id/images/roblox-skins-boy-free_GM431946152.pdf
- https://pa-waingapu.go.id/images/rbx-free-robux_GM431946152.pdf
- https://pa-waingapu.go.id/images/free-robux-no-anti-bot-verification_GM431946152.pdf
- https://pa-waingapu.go.id/images/free-robux-site_GM431946152.pdf
- https://pa-waingapu.go.id/images/coin-master-mod-version-free-download-v344_GM406889139.pdf
- https://pa-waingapu.go.id/images/coin-master-34-4-hack_GM406889139.pdf
- https://pa-waingapu.go.id/images/coin-drop-master-free_GM406889139.pdf
- https://pa-waingapu.go.id/images/cute-free-roblox-outfits_GM431946152.pdf
- https://pa-waingapu.go.id/images/minecraft-aimbot_GM479516143.pdf
- https://pa-waingapu.go.id/images/get-free-robux-without-doing-anything_GM431946152.pdf
- https://pa-waingapu.go.id/images/free-roebucks-com_GM431946152.pdf
- https://pa-waingapu.go.id/images/free-robux-no-verification-at-all_GM431946152.pdf
- https://pa-waingapu.go.id/images/free-robux-no-human-verification_GM431946152.pdf
- https://pa-waingapu.go.id/images/free-spin-and-coin-links_GM406889139.pdf
- https://pa-waingapu.go.id/images/android-coin-master-3433-apk-hack_GM406889139.pdf
- https://pa-waingapu.go.id/images/coin-master-hack-mod-apk-free-download_GM406889139.pdf
- https://pa-waingapu.go.id/images/coin-master-real-hack_GM406889139.pdf
- https://pa-waingapu.go.id/images/sites-to-get-free-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005185.bin` `228cccc6f201a3483178673cf36674d77de6192c4badd880503413dbe8caf5a3`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5185	26416 bytes
`font_01_sfnt_off00008c66.bin` `78b53121be44e8812465e1cf5169458885f12d2527fb9e057dfb071290ba9ce2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C66	4584 bytes
`font_02_sfnt_off00009b50.bin` `e59bc53cd4c0ee65dc1533becad2866f345dcb060e6c68bb8187d21cb9f973ee`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9B50	3396 bytes
`font_03_sfnt_off0000a743.bin` `e96adde0ace441b49972f627c56f14a6b7058f9a3f515039b18d3ecb5ad2e171`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA743	19108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.