PDF malware analysis — malicious · b9ee2eeaec769ddc

MALICIOUS

PDF

228.3 KB Created: 2021-07-05 05:47:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: dc6f2ab0c5dfc85dabbffbcca2dc6a67 SHA-1: 3f21d482ea657c2d2f5a3f71dc1a9fb4e6729091 SHA-256: b9ee2eeaec769ddc6f56b1b44bc041fed6542da1f887635dd15416ef182d9dbd

132 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a fake CAPTCHA and a call-to-action to trick users into downloading a fake application or browser extension. It contains multiple embedded URLs, one of which is http://netcdn.tw/app/1094591345/pokemon-go-free-download-latest-version-game-hack, likely serving as a download link for a malicious payload. No scripts were extracted from this sample, limiting the analysis of its execution flow.

Machine Learning

Nyx PDF Classifier clean score 0.0118

Heuristics 6

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/1094591345/pokemon-go-free-download-latest-version-game-hack
- https://vireco-online.com/ckfinder/userfiles/files/how-to-get-robux-fast_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/counter-blox-roblox-offensive-hacks-2021-how-to-get-money_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/free-robux-without-human-verification_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/free-robux-app_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/can-you-get-free-robux-on-roblox_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/rbx-land-free-robux_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/coin-master-free-coins-2021_GM406889139.pdf
- https://vireco-online.com/ckfinder/userfiles/files/roblox-hacks-2021-epicmini-games_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/can-you-download-roblox-on-ps4-free_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/free-robux-websites-that-actually-work_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/reddit-coin-master-hack_GM406889139.pdf
- https://vireco-online.com/ckfinder/userfiles/files/hack-any-roblox-account-program_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/roblox-rewards-robux_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/free-links-for-free-coins-and-spins-for-coin-master_GM406889139.pdf
- https://vireco-online.com/ckfinder/userfiles/files/free-robux-for-free_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/roblox-hack-me_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/free-account-roblox-2021_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/free-robux-glitch-2021_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/get-free-robux-generator_GM431946152.pdf
- https://vireco-online.com/ckfinder/userfiles/files/how-to-hack-roblox-on-chat-bar_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_023_off0003237e.bin` `420d78a6327f67ba1a0a948a77cac77ce3a24f2d15fcebd26241815648a6d8fc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3237E	25576 bytes
`font_01_sfnt_off00035f7e.bin` `9f0bd892a02ee5aecff46ebe7d0911569a1aa0954041f439815eb031b44a3f88`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x35F7E	19296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.