Malicious PDF — malware analysis report

Static analysis result for SHA-256 8659f6873d716d4e…

MALICIOUS

PDF

44.9 KB Created: 2021-06-03 13:04:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 7441adf5569febb334cc2e3dd6605f04 SHA-1: db355b4b835b08fe11257dd2e850661b7a653c57 SHA-256: 8659f6873d716d4eecf24016596d0fa6cfdca6b2a0ad8291b42a6c8a0b0859ae
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a fake CAPTCHA lure, designed to trick users into interacting with a malicious download link. The embedded URL, https://netcdn.online/app/431946152/roblox-promo-codes-free-robux-game-hack, likely serves as the initial stage for downloading a secondary payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/roblox-promo-codes-free-robux-game-hack
    • http://perpus.poltekeskupang.ac.id//repository/roblox-girl-avatar_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id/repository/roblox-fun-com-free-robux_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id/repository/multiplayer-master-hack-coins_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id//repository/daily-free-spins-coin-master_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/toolbox-premium-apk_GM479516143.pdf
    • http://perpus.poltekeskupang.ac.id/repository/coin-master-free-coins-and-spins-today_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/coin-master-400-spin-link-today_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id//repository/coin-master-free-gift-cards_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/cm-free-spins_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/apps-that-give-you-free-robux_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id//repository/coin-master-free-spins-coins_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/windows-10-minecraft-free-with-java_GM479516143.pdf
    • http://perpus.poltekeskupang.ac.id//repository/free-roblox-clothes-girl_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id//repository/tiktok-free-folowers-jio_GM835599320.pdf
    • http://perpus.poltekeskupang.ac.id//repository/free-roblox-groups-with-funds_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id//repository/cmaster-club-coin-master-hack-tool_GM406889139.pdf
    • http://perpus.poltekeskupang.ac.id/repository/roblox-re_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id/repository/minecraft-linux-free_GM479516143.pdf
    • http://perpus.poltekeskupang.ac.id/repository/is-roblox-free-on-pc_GM431946152.pdf
    • http://perpus.poltekeskupang.ac.id//repository/how-can-i-get-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000501d.bin
b00f3d538ef8a10f82d50d0018d32aab3e39fa870a5e83e1a29f6bf94713e26b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x501D 25792 bytes
font_01_sfnt_off00008bc9.bin
3ed324e585500d41944ebd93500991c566830021fec9c5a8323b790459c3443f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BC9 18676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.