PDF malware analysis — malicious · 95cc2fa7c9467455

MALICIOUS

PDF

45.2 KB Created: 2021-06-09 09:00:58 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: e5ba37b29156f07dcb02da749bdbcafa SHA-1: ceca2a11bbefba6850545000eb0b0d7add773987 SHA-256: 95cc2fa7c9467455e8776de3686089099edb5c8ae6782e4c0e66c8fcd5dc2042

122 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents a fake CAPTCHA and a "download button" lure, strongly suggesting an attempt to trick the user into executing a malicious payload or providing sensitive information. The presence of multiple URLs pointing to similar scam-like content indicates a phishing or scam campaign. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9864

Heuristics 5

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
MFA / one-time-code harvesting lure high SE_MFA_LURE

Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/enter-thsi-pin-to-get-free-robux-game-hack
- http://pesok-rk.ru/images/how-to-get-free-tiktok-fans_GM835599320.pdf
- http://pesok-rk.ru/images/free-robux-without-verification-2021_GM431946152.pdf
- http://pesok-rk.ru/images/how-to-hack-and-get-free-robux_GM431946152.pdf
- http://pesok-rk.ru/images/how-to-hack-a-minecraft-server-and-make-yourself-op_GM479516143.pdf
- http://pesok-rk.ru/images/hallows-eve-2021-roblox-cheats_GM431946152.pdf
- http://pesok-rk.ru/images/how-to-get-robux-easy_GM431946152.pdf
- http://pesok-rk.ru/images/instant-free-spins-coin-master_GM406889139.pdf
- http://pesok-rk.ru/images/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdf
- http://pesok-rk.ru/images/free-roblox-gift-card-generator-no-survey_GM431946152.pdf
- http://pesok-rk.ru/images/coin-master-free-spins-2021_GM406889139.pdf
- http://pesok-rk.ru/images/how-to-get-free-snacks-on-coin-master_GM406889139.pdf
- http://pesok-rk.ru/images/free-minecraft-maps_GM479516143.pdf
- http://pesok-rk.ru/images/roblox-got-talent-piano-hack_GM431946152.pdf
- http://pesok-rk.ru/images/get-free-spins-coin-master-link_GM406889139.pdf
- http://pesok-rk.ru/images/free-minecraft-skin-maker_GM479516143.pdf
- http://pesok-rk.ru/images/free-robux-images_GM431946152.pdf
- http://pesok-rk.ru/images/free-robux-websites-that-actually-work_GM431946152.pdf
- http://pesok-rk.ru/images/coin-master-free-spins-link-hack_GM406889139.pdf
- http://pesok-rk.ru/images/get-robux-today_GM431946152.pdf
- http://pesok-rk.ru/images/free-robux-redeem-codes_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000050c7.bin` `008a95f5c8531512bf83638cac08795d7d92b026657a0c356cd8e36177ee7fb6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x50C7	27476 bytes
`font_01_sfnt_off00008d83.bin` `d838098cb1398ffbdd239e927f59e03648dcbffe44044b96d7c37f72ee1bf803`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8D83	18556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.