Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d65dd6141ae4206…

MALICIOUS

PDF

42.8 KB Created: 2021-05-11 01:33:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c640a5045b1331a8cbc068cf05051003 SHA-1: 69e42f55792b8446609fe9db92dd52a9a4bfb1a4 SHA-256: 7d65dd6141ae42064f9e3a51053a7d02f5a3bf7ff90a89697b402e0e250b0f64
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains a fake CAPTCHA lure, a common social engineering tactic to trick users into interacting with malicious content. It also embeds external URLs, one of which is associated with a 'teach-me-to-hack' theme, suggesting a lure for potentially harmful downloads or phishing. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9900

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/teach-me-to-hack-game-hack
    • http://dev.pmrscambodia.org/images/uploadfiles/is-minecraft-free-on-pc_GM479516143.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/free-robux-thumbnail_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-free-spin-ml_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/actual-free-robux_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-get-free-robux-without-downloading-apps_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-fan-page-free-spins_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-hack-to-get-free-spins_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-email-rewards-link_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-hacks-for-free-spins_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-hack-spin-generator_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-hack-apk-download-2021_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coinmaster-gps-user-review-coinmaster-coin-master-hack-pagedemo-index_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/minecraft-free-ios-2021_GM479516143.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-instagram-free-spins_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/wurst-18_GM479516143.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/free-roblox-accounts-2021-with-robux_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/freespincoin-masterlinkdownload_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/https-rbx-place-rewards_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/minecraft-java-edition-free-trial_GM479516143.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-change-roblox-name-for-free_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000433b.bin
94100f926b8b0cc388492ae92027b8b253a74dc8d944927e91555b07661f2a6a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x433B 24620 bytes
font_01_sfnt_off00007bc4.bin
77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BC4 2832 bytes
font_02_sfnt_off00008575.bin
45a7ad0662f64c0d6803e23403df750b51a04dc480005b571e4443f6e5fef777		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8575 18100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.