Malicious PDF — malware analysis report

Static analysis result for SHA-256 7efb05c204f374c7…

MALICIOUS

PDF

45.4 KB Created: 2021-06-08 22:30:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 8d88d9d05022e3c70406b5348c00dd08 SHA-1: ef0164bc6a24b678f92923bbed8894a618f7446b SHA-256: 7efb05c204f374c7fcf2981f68db8b9b3d44667186a487a45bdf5d7f2e2d11eb
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a fake CAPTCHA or human verification prompt to trick the user into clicking a link, likely to download a second-stage payload. The embedded URL and numerous other URLs found in the document body point to sites offering game hacks and cheats, reinforcing the lure. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-non-free-models-game-hack PDF link annotation
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-free-spin-today_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-free-coins-and-spins-hack_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/free-robux-no-verification-no-download-2021_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/roblox-hack-generator_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-free-spins-link-blogspot_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/how-to-get-free-robux-hack-2021_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-hack-mod-apk-unlimited-spins_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-hack-xyz_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-hack-pro_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/roblox-fun-com-free-robux_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/free-spins-on-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/roblox-hack-me_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/hack-de-robux-en-roblox-espaol-en-3-minutos_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-free-spins-deutsch-download-ios-link_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/roblox-free-followers_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/can-you-get-robux-for-free_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/how-to-get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/coin-master-ios-hack_GM406889139.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/promo-code-free-robux_GM431946152.pdfIn PDF document text
    • https://beershebaschool.edu.np/ckfinder/userfiles/files/how-to-get-free-skins-in-minecraft_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005159.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5159 26360 bytes
SHA-256: b469f6ad16ecef49f257b574ebd5e96d5a47821d70802b2e9072a19a7c2a9164
font_01_sfnt_off00008ee8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8EE8 18316 bytes
SHA-256: 08f47c6188e5841de067291d7d302a37f8c9e64affc5c979522aab444320d924

Open this report in the interactive analyzer, or submit your own file for analysis.