Malicious PDF — malware analysis report

Static analysis result for SHA-256 7aa68f1e1c89aea6…

MALICIOUS

PDF

42.0 KB Created: 2021-05-24 02:13:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: dcfa11789828f30fd6d50fc075d5e03c SHA-1: 7c62fabd6e1c1e58831dc198e4f29dec66674c3e SHA-256: 7aa68f1e1c89aea6f8898365b50a32f664cdfefc8c913ed5311dc8bc134775e4
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a fake CAPTCHA lure, aiming to trick the user into clicking a link. The primary external URI points to a URL associated with 'coin-master-hack-game-hack', suggesting a scam or game-related exploit. Several other embedded URLs also point to similar game-related lures, indicating a potential download or redirection to a malicious site. No scripts were extracted, but the presence of a fake CAPTCHA and external links strongly suggests an attempt to exploit user interaction for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8120

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-hack-game-hack
    • http://jenne-technik.de/images/i-robux_GM431946152.pdf
    • http://jenne-technik.de/images/roblox-free-item-codes_GM431946152.pdf
    • http://jenne-technik.de/images/free-roblox-accounts-with-robux_GM431946152.pdf
    • http://jenne-technik.de/images/free-spins-coin-master-app_GM406889139.pdf
    • http://jenne-technik.de/images/how-to-hack-roblox-accounts-for-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000037c6.bin
d71484e747839ab5d4e6972fcca5b48e035aef01d80ab8df96aea529fb28f89d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37C6 29660 bytes
font_01_sfnt_off00007934.bin
2756f1aee481866e7be68ea9759d1a1529e56124c339b6d6ce98461e9bcfc10d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7934 3264 bytes
font_02_sfnt_off0000847f.bin
c15a8689411d8cca9ab0759ab4c496fe9b4353d676dd738e300719e9588112ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x847F 17716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.