PDF malware analysis — malicious · 8ab95c52c1de378c

MALICIOUS

PDF

41.3 KB Created: 2021-05-11 04:33:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 0e5ee478d39e956ad8daaf3650fef6ca SHA-1: cb7c9b1d51665ceefd20670d6e79bd5a951b092c SHA-256: 8ab95c52c1de378cbcd5bb1baea4258bbeca70c6e3e79065eaa3e485e25e4159

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document displays a fake CAPTCHA lure to deceive the user into performing an action, likely to download a secondary payload from the embedded URL. The ML classifier strongly indicates maliciousness, and the presence of multiple external URLs suggests a download or redirection attempt. No scripts were extracted, limiting the ability to determine the exact execution flow.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coinmasterfreespinlink-game-hack
- http://www.travelone.ae/userfiles/files/10-robux_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/how-to-get-free-robux-codes-2021_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/coin-master-hack-2021-without-verification_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/free-spins-coin-master-app_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/rbx-gg-free-robux_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/www-coin-master-hack_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/how-to-get-minecraft-realms-for-free_GM479516143.pdf
- http://www.travelone.ae/userfiles/files/coin-master-free_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/coins-master-hacks_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/how-to-get-free-robux-for-kids_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/spin-rewards-coin-master_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/coin-master-hack-android-no-root_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/easy-how-to-get-free-robux_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/coin-master-free-spin-link-twitter_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/roblox-hack-com_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/free-robux-without-verification-2021_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/free-coin-master-cards-link_GM406889139.pdf
- http://www.travelone.ae/userfiles/files/minecraft-survival-hacks_GM479516143.pdf
- http://www.travelone.ae/userfiles/files/free-robux-codes-no-verification-2021_GM431946152.pdf
- http://www.travelone.ae/userfiles/files/free-minecraft-hacks_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000047a0.bin` `5e454d2557931e3e4a8fc43b24654e69bfec4980694453f889fce5e6f021b0ac`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47A0	25008 bytes
`font_01_sfnt_off00007f69.bin` `5ac1ce2ac88e7b98134a23e8a83b406c8e40c127b2dbab09a4edbea00c7c47cb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F69	18224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.