Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf240e06a90d4c32…

MALICIOUS

PDF

43.9 KB Created: 2021-05-14 13:39:52 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 2b1494252d3931cdde9ab276f5760ef6 SHA-1: 56e8eeed90acfb042d1ee86ba01df6271d43db56 SHA-256: cf240e06a90d4c32d572b2d9e8a8ef725673076a7e9c5b0f325321c2f70eb81e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents a fake CAPTCHA to trick the user into clicking a link, likely to download a malicious application. The embedded URL and numerous other URLs found in the document body point to sites offering game hacks and free Robux, suggesting a lure for potentially unwanted or malicious software. No scripts were extracted, but the presence of external URIs and the fake CAPTCHA heuristic strongly indicate a social engineering attempt to lead the user to a malicious download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/apps-to-get-free-robux-game-hack
    • http://the-specials.ch/images/coin-master-hack-app-2021_GM406889139.pdf
    • http://the-specials.ch/images/unlimited-robux-2021_GM431946152.pdf
    • http://the-specials.ch/images/free-robux-2021_GM431946152.pdf
    • http://the-specials.ch/images/hack-coin-master-pc_GM406889139.pdf
    • http://the-specials.ch/images/how-to-get-free-spins-on-coin-master-hack_GM406889139.pdf
    • http://the-specials.ch/images/hack-coin-master-net_GM406889139.pdf
    • http://the-specials.ch/images/how-to-get-free-coins-and-spins-on-coin-master_GM406889139.pdf
    • http://the-specials.ch/images/minecraft-survival-hacks_GM479516143.pdf
    • http://the-specials.ch/images/how-to-get-free-coins-in-coin-master_GM406889139.pdf
    • http://the-specials.ch/images/free-robux-only-username_GM431946152.pdf
    • http://the-specials.ch/images/coin-master-free-spins-coins_GM406889139.pdf
    • http://the-specials.ch/images/free-links-for-coin-master-2021_GM406889139.pdf
    • http://the-specials.ch/images/free-robux-rewards_GM431946152.pdf
    • http://the-specials.ch/images/free-robux-no-verification-no-survey_GM431946152.pdf
    • http://the-specials.ch/images/coin-master-free-spons-apk-2021_GM406889139.pdf
    • http://the-specials.ch/images/bad-minecraft-free_GM479516143.pdf
    • http://the-specials.ch/images/minecraft-java-edition-free-code_GM479516143.pdf
    • http://the-specials.ch/images/get-coin-master-free-spin_GM406889139.pdf
    • http://the-specials.ch/images/comapp-trekfree-coin-spindaily-link-master_GM406889139.pdf
    • http://the-specials.ch/images/minecraft-wurst_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000049e8.bin
058dd331e35242ad7842731aaa666ff4108d8c51c17036c0895edb54c569eb36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49E8 27720 bytes
font_01_sfnt_off00008953.bin
b4e5860ebf2343f9b18b94d86a305cbc7e8ebd2f2a6bfe7ceeed88b67548d8bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8953 18292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.