PDF malware analysis — malicious · ab1c2e518fe44e5e

MALICIOUS

PDF

41.9 KB Created: 2021-06-14 01:43:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 0f9c0d99d7c58a4988f35fab5d8d2c93 SHA-1: c3891dbbd003aef4aa0b685dbfea3c486461e5dc SHA-256: ab1c2e518fe44e5e04eab18879d5de2267cc73e5b11c6af43c306048afb0ed15

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document displays a fake CAPTCHA and includes a call-to-action to download a file related to game cheats, strongly suggesting a social engineering lure. The embedded URL points to a potential second-stage payload, likely intended to be downloaded and executed by the user. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/roblox-hack-jailbreak-2021-game-hack
- https://www.manmed.info:443/images/_GM479516143.pdf
- https://www.manmed.info:443/images/free-robux-codes-2021_GM431946152.pdf
- https://www.manmed.info:443/images/coin-master-free-spins-and-coins-daily_GM406889139.pdf
- https://www.manmed.info:443/images/free-minecraft-realms-to-join_GM479516143.pdf
- https://www.manmed.info:443/images/how-to-hack-roblox-account-2021_GM431946152.pdf
- https://www.manmed.info:443/images/500-free-coin-master-spins_GM406889139.pdf
- https://www.manmed.info:443/images/tiktok-viewer-free_GM835599320.pdf
- https://www.manmed.info:443/images/get-minecraft-for-free_GM479516143.pdf
- https://www.manmed.info:443/images/how-to-make-a-free-admin-game-in-roblox_GM431946152.pdf
- https://www.manmed.info:443/images/minecraft-free-install_GM479516143.pdf
- https://www.manmed.info:443/images/how-to-earn-free-robux_GM431946152.pdf
- https://www.manmed.info:443/images/minecraft-bedrock-for-free_GM479516143.pdf
- https://www.manmed.info:443/images/how-to-get-free-robux-on-computer_GM431946152.pdf
- https://www.manmed.info:443/images/hire-a-roblox-hacker_GM431946152.pdf
- https://www.manmed.info:443/images/free-robux-id-roblox_GM431946152.pdf
- https://www.manmed.info:443/images/legit-coin-master-hack-site-zyngaplayerforumscom_GM406889139.pdf
- https://www.manmed.info:443/images/coin-master-hack-app-for-ios_GM406889139.pdf
- https://www.manmed.info:443/images/free-tiktok-likes-and-followers_GM835599320.pdf
- https://www.manmed.info:443/images/roblox-hacks-for-mac_GM431946152.pdf
- https://www.manmed.info:443/images/roblox-login-hack-for-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000474e.bin` `819e7dcfe00a255f07372b43ac4362008bc70040f33b7716f00a31b20e64b093`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x474E	24588 bytes
`font_01_sfnt_off00007f42.bin` `6904fb95121c1c1438a893c3deaa45abc163de94bbdac3041960213d42302a7a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F42	18868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.