PDF malware analysis — malicious · 9b52d74f221a80ff

MALICIOUS

PDF

46.5 KB Created: 2021-06-03 11:14:36 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: f681894eeb070ff840a41909cf9d0ce8 SHA-1: c84f6cd64877f5a4f4e88bfacdba17ae47f667ee SHA-256: 9b52d74f221a80ff27b90666e8cd2bc5015feae2168afdcd8d79dd9525de7048

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains a fake CAPTCHA lure, directing users to click on embedded URLs. The primary URL, https://netcdn.online/app/406889139/free-links-for-coin-master-game-hack, likely leads to a malicious payload download. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9748

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.online/app/406889139/free-links-for-coin-master-game-hack
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/free-robux-hack-no-human-verification_GM431946152.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/how-to-get-a-free-dominus-in-roblox_GM431946152.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/coin-master-download-hack_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/robux-page_GM431946152.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/coin-master-hack-iosgods_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/best-way-to-hack-coin-master_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/free-robux-only-1-step_GM431946152.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/minecraft-noob-vs-pro-vs-hacker-vs-god_GM479516143.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/minecraft-java-hacks_GM479516143.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/tiktok-minecraft-hacks_GM479516143.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/minecraft-classic-free_GM479516143.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/roblox-games-with-free-radio_GM431946152.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/coin-master-hack-without-verification-2021_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-link-2021-today_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/free-coin-master-spins-hack_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/reddit-coin-master-free-spins_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/minecraft-115-2-hacks_GM479516143.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/free-coin-master-coins-2021_GM406889139.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/free-robux-codes_GM431946152.pdf
- https://www.polresbadung.id/new/public/ckfinder/userfiles/files/free-vip-roblox_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005117.bin` `5ed71f06386e7d0b424125c857e7a88522b5a419ebbb6cc23803b8d290dc2136`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5117	24824 bytes
`font_01_sfnt_off00008a32.bin` `10d025f04f706eb71cdda4f99784df1b9ccb52e48080e43095e0398eaef6f132`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A32	2880 bytes
`font_02_sfnt_off0000941d.bin` `a04fca5b08559e76c7fc5751e50b7e5576d0693cd390b0db561ab022dd525d54`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x941D	17880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.