Malicious PDF — malware analysis report

Static analysis result for SHA-256 a91f0a471e29e657…

MALICIOUS

PDF

47.5 KB Created: 2021-06-03 13:45:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 29ad3d12e4482105ab825dd4e12d971e SHA-1: 0156867eaee133ee092eeb374598917c010c8562 SHA-256: a91f0a471e29e6575709eeeb08ea73fad8ad661a6e2056bccac46be6322b66a7
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a fake CAPTCHA and a download button, indicating a lure to trick users into clicking malicious links. The embedded URL and numerous other URLs found within the document suggest an attempt to redirect users to potentially malicious sites for credential harvesting or further payload delivery. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9832

Heuristics 5

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/free-promo-codes-for-roblox-2021-game-hack
    • https://digilib.widyagamahusada.ac.id/repository/minecraft-free-demo_GM479516143.pdf
    • https://digilib.widyagamahusada.ac.id/repository/how-to-hack-roblox-on-mobile_GM431946152.pdf
    • https://digilib.widyagamahusada.ac.id/repository/free-coin-master-hacks-no-verification_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/coin-master-free-cards-link_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/get-robux-for-free-2021_GM431946152.pdf
    • https://digilib.widyagamahusada.ac.id/repository/spin-free-coin-master_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/coin-master-hack-android_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/roblox-piano-hack_GM431946152.pdf
    • https://digilib.widyagamahusada.ac.id/repository/minecraft-hack-app_GM479516143.pdf
    • https://digilib.widyagamahusada.ac.id/repository/coin-master-free-coins-and-spins_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/how-to-get-free-robux-hack-2021_GM431946152.pdf
    • https://digilib.widyagamahusada.ac.id/repository/minecraft-apk-download-v1-144-2-free_GM479516143.pdf
    • https://digilib.widyagamahusada.ac.id/repository/coin-master-links-to-get-free-spins_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/robux-free-promo-codes_GM431946152.pdf
    • https://digilib.widyagamahusada.ac.id/repository/how-to-make-my-own-coin-master-cards-hack_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/coin-master-free-spin-link-today-50_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/is-minecraft-vr-free_GM479516143.pdf
    • https://digilib.widyagamahusada.ac.id/repository/free-robux-just-enter-username_GM431946152.pdf
    • https://digilib.widyagamahusada.ac.id/repository/coin-master-hack-without-verification-code_GM406889139.pdf
    • https://digilib.widyagamahusada.ac.id/repository/coin-master-heaven-free-spins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000541b.bin
6a94848de33397e9a0e36c62b74362c24fcd5f586873b9f60d5fed25822b8f65		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x541B 28724 bytes
font_01_sfnt_off0000952c.bin
2b6c19c1385541cbc0a307a9e655f394479c142689a532ede3fefaf993bbe264		 pdf-font-stream PDF embedded font (sfnt) at offset 0x952C 18936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.