Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b678cb49ed70484…

MALICIOUS

PDF

45.9 KB Created: 2021-05-17 05:35:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 131a3f93068e85fcc6bef8ac62b744d5 SHA-1: 7eb0f3592a3534940589972d037adbe3751fbafe SHA-256: 8b678cb49ed70484d9d1f3396469d1ca62cf5835807a01a9a24ab0a25fac9a26
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document displays a fake CAPTCHA to lure the user into downloading malicious content, as indicated by the SE_FAKE_CAPTCHA heuristic. The embedded URL, https://netcdn.xyz/app/431946152/microsoft-robux-game-hack, likely serves as the download source for a secondary payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/microsoft-robux-game-hack
    • https://www.dossiermedicina.it/images/coin-master-hack-programmers_GM406889139.pdf
    • https://www.dossiermedicina.it/images/xray-hack_GM479516143.pdf
    • https://www.dossiermedicina.it/images/coin-master-daily-free-spins-link-download_GM406889139.pdf
    • https://www.dossiermedicina.it/images/roblox-comroblox_GM431946152.pdf
    • https://www.dossiermedicina.it/images/roblox-free-robux-hack_GM431946152.pdf
    • https://www.dossiermedicina.it/images/how-to-get-free-robux-hack-2021_GM431946152.pdf
    • https://www.dossiermedicina.it/images/free-robux-script_GM431946152.pdf
    • https://www.dossiermedicina.it/images/real-free-spins-for-coin-master_GM406889139.pdf
    • https://www.dossiermedicina.it/images/codes-to-get-free-robux_GM431946152.pdf
    • https://www.dossiermedicina.it/images/free-face-roblox_GM431946152.pdf
    • https://www.dossiermedicina.it/images/how-to-hack-roblox-to-get-robux_GM431946152.pdf
    • https://www.dossiermedicina.it/images/where-can-i-get-free-spins-for-coin-master_GM406889139.pdf
    • https://www.dossiermedicina.it/images/hacked-roblox-accounts-list_GM431946152.pdf
    • https://www.dossiermedicina.it/images/coin-master-hack-without-verification-code-2021_GM406889139.pdf
    • https://www.dossiermedicina.it/images/roblox-speed-hack_GM431946152.pdf
    • https://www.dossiermedicina.it/images/how-to-download-wurst_GM479516143.pdf
    • https://www.dossiermedicina.it/images/how-to-get-minecraft-for-free-on-ps4_GM479516143.pdf
    • https://www.dossiermedicina.it/images/krnl-roblox_GM431946152.pdf
    • https://www.dossiermedicina.it/images/free-robux-hack-us_GM431946152.pdf
    • https://www.dossiermedicina.it/images/how-to-get-free-spins-on-coin-master-facebook_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00005042.bin
0e98f09491cfe721452e2a1c0801f1f6d467df4b1ed43bbc7533002a9f423b7f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5042 28192 bytes
font_01_sfnt_off00009170.bin
1dad11f1b0cc625372b0651201a25e80b2883247dfadd7ecaa87d1c2f9bc49a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9170 18268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.