Malicious PDF — malware analysis report

Static analysis result for SHA-256 8eafa689da81c6cb…

MALICIOUS

PDF

45.8 KB Created: 2021-06-10 14:33:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 498dd3a0afa9317c2441ba32ca57a72e SHA-1: 6a45c61098fa4d3cdc054a7ca6ff3b0fd98267f7 SHA-256: 8eafa689da81c6cbbab0d7357c02647e4ba50fe9ea6fd7e280f30231c1269d2e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a fake CAPTCHA or human verification prompt to trick the user into downloading a file from a provided URL. The content suggests a lure related to game hacks, specifically for Roblox and Coin Master. The presence of multiple external URLs further supports the malicious intent of directing users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 5

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-green-pants-roblox-game-hack
    • http://perpustakaan.sman2bondowoso.sch.id/repository/coin-master-game-legitimate-hack-without-signing-up-or-shareing_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/how-to-actually-get-free-robux_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/free-spins-generated-from-coin-master_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/coin-master-mod-apk-latest-hack-with-unlimited-free-spins_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/spin-link-coin-master_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/mc-hacks_GM479516143.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/how-to-hack-roblox-accounts-on-phone-2021_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/how-to-get-free-daily-spins-on-coin-master_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/roblox-free-robux-no-human-verification_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/robux-online_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/but-link-says-free-robux_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/coin-master-game-hack-app-download_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/free-robux-websites-no-human-verification_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/rbxoffers-earn-free-robux_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/free-robux-hacks-no-verification_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/free-coin-app_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/how-to-get-free-spins-and-coins-in-coin-master_GM406889139.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/robux-in_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/roblox-free-hood_GM431946152.pdf
    • http://perpustakaan.sman2bondowoso.sch.id/repository/roblox36com-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005374.bin
4e7bd79eacb125d9523e9df302fdbeb4c560d12ae228aa2e177f3fcfe0ef152d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5374 27824 bytes
font_01_sfnt_off0000900e.bin
618fc26a398beb651a1f837c534012097e78fbb7ba8e7c46f665adafa1eb82cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x900E 18436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.