Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba89f276535e0e72…

MALICIOUS

PDF

37.0 KB Created: 2021-05-21 10:08:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 7b89c3bfbf7ca54ecebc908a89d77bdf SHA-1: a206c5b47c0e36adec0225e188b4d8d706ac6661 SHA-256: ba89f276535e0e722fc7006f35f053dfcbe78b1a0917c33bff65553cbe3a000a
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA lure, designed to trick users into interacting with the document. It also embeds multiple URLs, one of which is presented as a direct link to a 'free roblox accounts' generator, suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9447

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-roblox-accounts-that-work-game-hack
    • http://internetdeputy.com/images/minecraft-free-apk-download-016-0_GM479516143.pdf
    • http://internetdeputy.com/images/how-to-change-your-name-in-roblox-for-free_GM431946152.pdf
    • http://internetdeputy.com/images/free-robux-picture_GM431946152.pdf
    • http://internetdeputy.com/images/free-robux-safe_GM431946152.pdf
    • http://internetdeputy.com/images/coin-master-hack-free-spins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032dd.bin
e0cfdf8a84184ebc5c5229edcb030a4c4b78f1edac4660c3848c93658b543176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32DD 25268 bytes
font_01_sfnt_off00006d75.bin
5a520a129cd8904d435b2c3265355279d09350e58b7119a0e5602aa69de64cf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D75 18952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.