Malicious PDF — malware analysis report

Static analysis result for SHA-256 73d402a7cf6b9bbe…

MALICIOUS

PDF

48.3 KB Created: 2021-06-04 02:34:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 040738bbe01ae166161b889cf9cca330 SHA-1: c84a7616c38d4df3fec86c79a155d215a99edbe6 SHA-256: 73d402a7cf6b9bbed0c905f4e45db2160f8a1653eb904d20ec4619e0c37898da
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a fake CAPTCHA heuristic, suggesting it's designed to trick users into interacting with it. It also contains an embedded URL pointing to a site offering 'free spins and coins' for Coin Master, a common lure for phishing or malware distribution. The ML classifier strongly flagged this PDF as malicious, and the presence of a download button heuristic further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/free-spins-and-coins-coin-master-2021-link-game-hack
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/coin-master-latest-mod-apk-free-download_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/coin-master-free-download_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/minecraft-free-play-no-download_GM479516143.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/free-robux-hack-no-human-verification_GM431946152.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/coin-master-hack-android-2021_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/good-free-minecraft-server-hosting_GM479516143.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/gamehunters-club-coin-master_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/minecraft-windows-10-key-free_GM479516143.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/roblox-army-free-robux_GM431946152.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/how-to-hack-a-roblox-account-2021_GM431946152.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/como-descargar-coin-master-hackeado_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/roblox-executor-free-download_GM431946152.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/coin-master-spin-hack_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/roblox-report-hacker_GM431946152.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/master-free-spin-and-coin-link_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/how-to-hack-coin-master-cheat-engine_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/2021-free-spins-coin-master_GM406889139.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/free-robux-without-human-verification-real_GM431946152.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/how-to-get-free-robux-on-ipad_GM431946152.pdf
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/pubg-uc-satn-al_GM1330123889.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000051e6.bin
3ff53d596c7701a58417aa7f5d9c9101473cbc5983d9588b2212c8a30344d213		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x51E6 26468 bytes
font_01_sfnt_off00008d8d.bin
ef35da004eaf08257d73b45a13041ea53fbba52fb81f85f0bc5fa9e5a1193e77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D8D 3460 bytes
font_02_sfnt_off000098fc.bin
e5cba94a653a55f068ca82f0c7712f51eecd5e3013a204785266329deafd7ed1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x98FC 18632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.