PDF malware analysis — malicious · 96a95fc070db5b69

MALICIOUS

PDF

43.3 KB Created: 2021-05-31 12:48:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 2983109cadf8d708d5f9606f52a173f2 SHA-1: aa7fa0a0a0b97edd67d0a32519984350834b0edd SHA-256: 96a95fc070db5b69059df34975669c727995a1cb46c13ba10b4d65b9583d1e6e

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains a fake CAPTCHA lure, aiming to trick users into interacting with malicious links. The presence of multiple embedded URLs, including one pointing to 'fps-roblox-free-game-hack', strongly suggests a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9865

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/fps-roblox-free-game-hack
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-play-minecraft-for-free_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/minecraft-name-tag-hacks_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/real-free-robux-codes_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/minecraft-hacked-client-112-2_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/minecraft-free-download-unblocked_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-generator-no-survey_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-codes_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-get-minecraft-windows-10-for-free_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/mobihack-net-roblox-hack_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-get-verified-on-tiktok-for-free-2021_GM835599320.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/robux-matchcomfree-robux_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/objet-roblox-free_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/wwwrobux-hacks_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/hack-of-roblox_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-get-free-robux-2021_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-jailbreak-hack_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-hacker-us_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-legit_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/minecraft-hacked-client_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/is-minecraft-dungeons-free_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00004eec.bin` `1492e8224f03524ff3402eb7ed44b02137b7cd1dae9d4e56350834184633c42a`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4EEC	25484 bytes
`font_01_sfnt_off0000871f.bin` `3a9fd6b57b36aed4b920715ea1717ba2f7fdc6c62822da24d3cb551d471474a1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x871F	18124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.