PDF malware analysis — malicious · b5593e6d6e979cd2

MALICIOUS

PDF

47.3 KB Created: 2021-06-10 22:47:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: b3ad05b533c92c9f85a1cbb71d2d370e SHA-1: 563c99669e585f7e06b199b2f8f2fdf9ee00de2c SHA-256: b5593e6d6e979cd2ca1a40081c1ee04187bcbac390ed058ca9887b064090b71f

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document displays a fake CAPTCHA and a download button lure, aiming to trick the user into interacting with malicious content. It contains an embedded URI pointing to a suspicious URL, likely for downloading a second-stage payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9832

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/free-roblox-promo-codes-december-2021-game-hack
- https://www.dc-itsolutions.com/userfiles/files/earn-robux-today_GM431946152.pdf
- https://www.dc-itsolutions.com/userfiles/files/minecraft-games-free-to-play-online_GM479516143.pdf
- https://www.dc-itsolutions.com/userfiles/files/get-free-roblox_GM431946152.pdf
- https://www.dc-itsolutions.com/userfiles/files/coin-master-free-spin-daily-link_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/free-spins-coin-master-2021_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/coin-master-free-spin-and-coin_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/how-to-get-free-spins-on-coin-master-facebook_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/roblox-online-free-no-download_GM431946152.pdf
- https://www.dc-itsolutions.com/userfiles/files/games-like-coin-master-for-free_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/how-to-get-minecraft-for-free-on-ipad_GM479516143.pdf
- https://www.dc-itsolutions.com/userfiles/files/robux-hack-no-reward-in-survey_GM431946152.pdf
- https://www.dc-itsolutions.com/userfiles/files/best-hacked-client_GM479516143.pdf
- https://www.dc-itsolutions.com/userfiles/files/hack-coin-master-android_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/roblox-free-robux-hack_GM431946152.pdf
- https://www.dc-itsolutions.com/userfiles/files/minecraft-112-hacked-client_GM479516143.pdf
- https://www.dc-itsolutions.com/userfiles/files/easy-robux-generator_GM431946152.pdf
- https://www.dc-itsolutions.com/userfiles/files/weird-roblox_GM431946152.pdf
- https://www.dc-itsolutions.com/userfiles/files/mcpe-master-unlimited-coins-hack-apk_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/hacks-for-coin-master_GM406889139.pdf
- https://www.dc-itsolutions.com/userfiles/files/coin-master-hack-app_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off000054a4.bin` `2650dc0cd877726c956065403b6cf5e93f287c29a35a66ae74120aba7d0418df`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x54A4	27696 bytes
`font_01_sfnt_off000093db.bin` `7f7b7a1ffa8b0a281ff5c1845932c82e18c9b883583f48df17ebd389203c49d3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x93DB	19108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.