Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b76ee471b00d50c…

MALICIOUS

PDF

44.5 KB Created: 2021-05-17 13:38:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 134223aab140ab33a24cfa6e2e5ec2b0 SHA-1: 2523229a29998e9f24c46cea6ee1677ba0a8043d SHA-256: 7b76ee471b00d50ccac7b665a710bc9bdb722c109bc9b565d88ea35986cfcbda
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA lure, aiming to trick the user into clicking a link for a "Robux Hack". The embedded URL and numerous other URLs point to sites offering game cheats and hacks, reinforcing the social engineering aspect. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9632

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-hack-no-verification-game-hack
    • https://kinderdam.nl/images/minecraft-hacks-ps4_GM479516143.pdf
    • https://kinderdam.nl/images/how-to-get-free-spins-in-coin-master_GM406889139.pdf
    • https://kinderdam.nl/images/minecraft-116-free_GM479516143.pdf
    • https://kinderdam.nl/images/roblox-army-free-robux_GM431946152.pdf
    • https://kinderdam.nl/images/roblox-premium-free_GM431946152.pdf
    • https://kinderdam.nl/images/coin-master-hack-apk-android_GM406889139.pdf
    • https://kinderdam.nl/images/minecraft-xbox-free_GM479516143.pdf
    • https://kinderdam.nl/images/legit-free-spins-coin-master_GM406889139.pdf
    • https://kinderdam.nl/images/need-free-spins-for-coin-master_GM406889139.pdf
    • https://kinderdam.nl/images/coin-master-hack-2021-ios-download_GM406889139.pdf
    • https://kinderdam.nl/images/como-hackear-coin-master-en-espaol_GM406889139.pdf
    • https://kinderdam.nl/images/free-spins-and-coins-for-coin-master_GM406889139.pdf
    • https://kinderdam.nl/images/free-robux-hack-generator_GM431946152.pdf
    • https://kinderdam.nl/images/how-to-get-unlimited-robux-2021_GM431946152.pdf
    • https://kinderdam.nl/images/coin-master-free-spins-link-2021-today_GM406889139.pdf
    • https://kinderdam.nl/images/get-me-robux-for-free_GM431946152.pdf
    • https://kinderdam.nl/images/daily-free-spin-and-coin_GM406889139.pdf
    • https://kinderdam.nl/images/coun-master_GM406889139.pdf
    • https://kinderdam.nl/images/fast-robux-online_GM431946152.pdf
    • https://kinderdam.nl/images/hack-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046b8.bin
e5eae91bef831f4a8f3514850838aaf770824517807eb5dcfb846fec554b606f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46B8 24100 bytes
font_01_sfnt_off00007d6a.bin
40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D6A 3884 bytes
font_02_sfnt_off00008a11.bin
770f8f6a3c3ea9ac3c319881d9f8005aae44889e6d1fc0dc42f8814bbcec8619		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A11 18604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.