Malicious PDF — malware analysis report

Static analysis result for SHA-256 be12a0056b7bb9b3…

MALICIOUS

PDF

35.2 KB Created: 2021-05-22 04:12:18 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 45bdf85cfa092b3278d3af84745580d7 SHA-1: f87c169f1233bcbb40e2fd89a370f8884d303cce SHA-256: be12a0056b7bb9b3deb600f75c9ef470065c082de52af75ab41d75716983d373
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a fake CAPTCHA and MFA lure, designed to trick the user into interacting with malicious links. The document body and embedded URLs suggest a lure related to free items or hacks, leading to potentially malicious downloads. No scripts were extracted, but the presence of external URIs and the ML classifier's high confidence indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9492

Heuristics 5

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/835599320/free-college-textbooks-tiktok-game-hack
    • http://classicskitours.net/images/minecraft-free-download-unblocked_GM479516143.pdf
    • http://classicskitours.net/images/coin-master-hack-coins_GM406889139.pdf
    • http://classicskitours.net/images/free-robux-today_GM431946152.pdf
    • http://classicskitours.net/images/coin-master-free-spins-youthnow_GM406889139.pdf
    • http://classicskitours.net/images/free-robux-pins_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000032f2.bin
9811a9ef5bdfbf5e14cb7b17f4bceccde088fd7a6d133099a3e01688ea9efad9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32F2 23624 bytes
font_01_sfnt_off0000689d.bin
c51aa8ed87b8ee8755a1ecd789814fb67703fc10c946440f5ae6e88abb0f8eda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x689D 18184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.