PDF malware analysis — malicious · ba3510243dff90be

MALICIOUS

PDF

42.2 KB Created: 2021-05-30 01:58:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 87ff684905c6aca6eba44dd4f9a50080 SHA-1: 2732b388e5002dd9cd11547b027c1f9d193a346c SHA-256: ba3510243dff90bec59ad87a80fdee423b3ed4a6f8339b18e28fab4a1a728139

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents a fake CAPTCHA to trick users into interacting with it, likely to initiate a download. The embedded URL and numerous other URLs point to sites offering game-related cheats and currency, suggesting a lure for potentially unwanted or malicious software. No scripts were extracted, but the presence of external URIs and the fake CAPTCHA heuristic strongly indicate a phishing or social engineering attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9974

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-free-spins-2021-game-hack
- https://hundt-druck.de/wp-content/uploads/fsqm-files/get-free-robux-generator_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/coin-master-free-spins-and-coins_GM406889139.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-legit_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-tiktok-accounts-with-followers_GM835599320.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-generator-no-human-verification-or-surveys_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-tiktok-followers-without-verification_GM835599320.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/huskybuckscom-free-robux_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-play-minecraft-for-free_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-gift-card_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-do-u-get-free-robux_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-codes_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/is-minecraft-bedrock-edition-free_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-get-minecraft-for-free-on-mobile_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-hack-a-minecraft-server_GM479516143.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-no-human-verification-or-survey-2021_GM431946152.pdf
- https://hundt-druck.de/wp-content/uploads/fsqm-files/blox-land-free-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off0000456a.bin` `0ba8c26d4505689ea1877eec7c443a06854343abd2358e02c514874bc7cbeac9`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x456A	29296 bytes
`font_01_sfnt_off000082c0.bin` `9f7609fba99e53c6baa99bb04d1c7e3f9b7167131c1520eb2a413cdab4a14871`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x82C0	18288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.