Malicious PDF — malware analysis report

Static analysis result for SHA-256 adbe1bf216d3997d…

MALICIOUS

PDF

37.4 KB Created: 2021-05-20 22:51:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: cb8e191947f02f75b014914eded43120 SHA-1: 35c0eae05c7fea249d4d8f3d02a909d7dd0145d2 SHA-256: adbe1bf216d3997d34a9c930c5c024ae32c4320635a1fc2df5cbea67ac3caee3
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure for "Free Robux" and displays a fake CAPTCHA to trick the user into clicking a malicious link. The embedded URL and multiple other related URLs point to sites offering game-related cheats and generators, consistent with social engineering tactics. No scripts were extracted, but the document's structure and content strongly suggest a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9447

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-that-actually-works-game-hack
    • https://www.titastar.com/uploaded_files/userfiles/files/free-robux-co_GM431946152.pdf
    • https://www.titastar.com/uploaded_files/userfiles/files/coin-master-free-spin-generator-without-human-verification_GM406889139.pdf
    • https://www.titastar.com/uploaded_files/userfiles/files/free-robux-hacks-no-verification_GM431946152.pdf
    • https://www.titastar.com/uploaded_files/userfiles/files/android-coin-master-3433-apk-hack_GM406889139.pdf
    • https://www.titastar.com/uploaded_files/userfiles/files/free-robux-ad_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003405.bin
9b3f4c9a9a470c5c396a0c367e589151a3651059decfd993f66902b8c715e596		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3405 24980 bytes
font_01_sfnt_off00006e32.bin
e9e8736bed1826902485352f20294e96b644ee357cd6186db79dc9b33c578c67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E32 19136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.