PDF malware analysis — malicious · ae273dca858aa66e

MALICIOUS

PDF

44.5 KB Created: 2021-06-04 01:03:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: c7c122b44f1b671d6716f4d4146f88c6 SHA-1: e8d7d9db94206604635a0ac320eac6d8fb21d5c5 SHA-256: ae273dca858aa66e28f3999591817f571b0b5041ced3e7af1383d222068e717f

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA lure to trick users into clicking a malicious link. The embedded URL, https://netcdn.online/app/406889139/free-spins-coin-master-links-2021-game-hack, likely leads to a payload download or a phishing page. The document's content and heuristics strongly suggest a social engineering attack aimed at user interaction.

Machine Learning

Nyx PDF Classifier malicious score 0.9865

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.online/app/406889139/free-spins-coin-master-links-2021-game-hack
- http://pustaka.bbppketindan.info//repository/how-to-get-free-robux-games_GM431946152.pdf
- http://pustaka.bbppketindan.info/repository/free-bobux_GM431946152.pdf
- http://pustaka.bbppketindan.info/repository/smart-lodhi-coin-master-hack_GM406889139.pdf
- http://pustaka.bbppketindan.info//repository/pubg-uc-free_GM1330123889.pdf
- http://pustaka.bbppketindan.info/repository/free-coin-master-spins-link-download_GM406889139.pdf
- http://pustaka.bbppketindan.info/repository/free-spins-coin-master-ios-2021_GM406889139.pdf
- http://pustaka.bbppketindan.info//repository/aimbot-download-roblox_GM431946152.pdf
- http://pustaka.bbppketindan.info//repository/coin-master-unlimited-spins-apk-free-download_GM406889139.pdf
- http://pustaka.bbppketindan.info//repository/coin-master-hack-no-download_GM406889139.pdf
- http://pustaka.bbppketindan.info//repository/coin-master-hack-progamers_GM406889139.pdf
- http://pustaka.bbppketindan.info//repository/coin-master-hack-pro-gamers-com_GM406889139.pdf
- http://pustaka.bbppketindan.info/repository/roblox-hackers-list_GM431946152.pdf
- http://pustaka.bbppketindan.info//repository/robux-earner_GM431946152.pdf
- http://pustaka.bbppketindan.info/repository/free-robux-with-no-verification-2021_GM431946152.pdf
- http://pustaka.bbppketindan.info/repository/coin-master-free-spins-and-coins-group_GM406889139.pdf
- http://pustaka.bbppketindan.info/repository/how-to-gift-robux-on-mobile_GM431946152.pdf
- http://pustaka.bbppketindan.info/repository/pubg-uc-purchase_GM1330123889.pdf
- http://pustaka.bbppketindan.info//repository/roblox-scam_GM431946152.pdf
- http://pustaka.bbppketindan.info//repository/daily-coin-master_GM406889139.pdf
- http://pustaka.bbppketindan.info//repository/get-me-robux-for-free_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005295.bin` `1519b6b2bf49cddc575b3aecc8444f3e7521d7c22d7d02a292a93424e1ae2056`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5295	24524 bytes
`font_01_sfnt_off00008aad.bin` `c809cb62993c96a2792eb05fd7593de41ec7ce02e3f179f2cd9cbcb899f0cf70`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8AAD	18456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.