Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9b3a2e3e8609cb4…

MALICIOUS

PDF

49.5 KB Created: 2021-05-11 14:01:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 021f6f7700fb166f3139a1a5e05d6ac2 SHA-1: 7782e9941f854b68158c90ff98dd057e6b7bb68a SHA-256: c9b3a2e3e8609cb4f2bb4f260d90357a436c7a3479129c3438fcc959abccca84
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a fake CAPTCHA to trick the user into interacting with a malicious link, likely leading to a payload download. The presence of multiple URLs related to game hacking and the ML classifier's high confidence score support this assessment. No scripts were extracted, limiting further analysis of the payload delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8642

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-hack-someone PDF link annotation
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/how-to-hack-coin-master-game-2021_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/roblox-phantom-forces-hack_GM431946152.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/coin-and-spin_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/roblox-free-robux-no-human-verification_GM431946152.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/coinmaster-spins_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/coin-master-online-hack_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/free-spins-and-coins-coin-master-2021-link_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/get-free-spins-link-in-coin-master_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/coin-master-apk-mod-free-download_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/get-free-spins-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-2021-easy_GM431946152.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/send-me-500-2021-spins_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/free-roblox-accessories_GM431946152.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/robux-offer-wall_GM431946152.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/free-roblox-codes-2021_GM431946152.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/free-minecraft-client_GM479516143.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/free-spin-link-for-coin-master-game_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/free-robux-apps-that-work_GM431946152.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/hack-my-game-xyz-coin-master_GM406889139.pdfIn PDF document text
    • https://www.elearning-ganjil.massimbangkulon.sch.id/__statics/gudangsoal/files/free-roblox-items-codes_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004bfa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4BFA 25200 bytes
SHA-256: 65a56c045a9e037d1bcf2c9cdd5c58326d508e291af0eb47cfd8e4c39a206393
font_01_sfnt_off0000867e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x867E 2844 bytes
SHA-256: baad2f3f6808f4af03fa9398e38c580c8d846f7f773a947d8cc1f39b2753d31a
font_02_sfnt_off0000903a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x903A 5596 bytes
SHA-256: 9a13c2580265a78e8a7257496a31ee0055738af7e20a5661c2902efe4bf05ce5
font_03_sfnt_off00009ce2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9CE2 18912 bytes
SHA-256: 995056b981027bfba3f97be2499ebace8b386febdb07856c531761fbe005e83e

Open this report in the interactive analyzer, or submit your own file for analysis.