Malicious PDF — malware analysis report

Static analysis result for SHA-256 9be31df583837f37…

MALICIOUS

PDF

36.8 KB Created: 2021-05-24 12:35:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 6d17dcbf0a9a62ea5580d073bfc97b77 SHA-1: a55887c73e3c0dfbe80f601199bb38d0c80bfb3c SHA-256: 9be31df583837f375846b201889620f7189c3baa9e1e1ea2a5032beeb17696df
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure for 'Free Robux' and displays a fake CAPTCHA, indicating a social engineering tactic to trick users. It includes multiple embedded URLs that likely lead to malicious content or further stages of an attack. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9447

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-get-free-robux-2021-no-human-verification-game-hack
    • https://datavoiz.com/images/roblox-mobile-hack_GM431946152.pdf
    • https://datavoiz.com/images/jailbreak-roblox-hack_GM431946152.pdf
    • https://datavoiz.com/images/coin-master-today_GM406889139.pdf
    • https://datavoiz.com/images/free-bling-bling-card-coin-master_GM406889139.pdf
    • https://datavoiz.com/images/free-coin-master-coins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034ad.bin
428c667d722a7eeff7d5c09016ae44f285b40535d4c9cfe849908c57fb13d6d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34AD 24044 bytes
font_01_sfnt_off00006aca.bin
dfc7ca414cfca4f80301273998e01ceb4bfd22e3de883fcbe9d6a0102e8d41a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6ACA 19428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.