Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf68ea669ece30a4…

MALICIOUS

PDF

50.6 KB Created: 2021-06-03 22:11:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 903e3a196a87721c4001f6893b857e30 SHA-1: 2c1cf47756f4ee08a2b48c240d8bf60f79ea1f5f SHA-256: cf68ea669ece30a41f5f7b7b7c34258feafd01acee5c4d262974ce93726383fd
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The sample is a PDF that displays a fake CAPTCHA or human verification prompt, a common lure to trick users into clicking malicious links or downloading further payloads. The embedded URL, https://netcdn.online/app/406889139/coin-master-34-5-hack-game-hack, likely leads to the download of a malicious file. The document's content and heuristics strongly suggest a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9681

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/coin-master-34-5-hack-game-hack
    • http://library.poltekkes-palangkaraya.ac.id//repository/www-free-robux-com_GM431946152.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/robux-place-rewards_GM431946152.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/hack-coin-master-game-apk_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/free-spin-link-for-coin-master_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/free-games-like-minecraft_GM479516143.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/coin-master-pc-game-free-download_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/microsoft-rewards-roblox_GM431946152.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/free-robux-gift-card_GM431946152.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/robloxhacks_GM431946152.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/google-how-do-you-get-free-robux_GM431946152.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/get-free-coin-master_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/coin-master-fan-page-facebook_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/get-coin-master-hack_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/minecraft-free-school_GM479516143.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/coin-master-free-pet-snacks_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/coin-master-free-spins-coins_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/card-hack-for-coin-master_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/coin-master-tricks_GM406889139.pdf
    • http://library.poltekkes-palangkaraya.ac.id/repository/free-minecraft-account-list_GM479516143.pdf
    • http://library.poltekkes-palangkaraya.ac.id//repository/coin-master-hack-2021-download_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000522a.bin
79bb46709a2cf38c7d9cfe1352cdea7f80408d46cf19c3f9a2d0a0dce4fe0492		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x522A 25068 bytes
font_01_sfnt_off00008b69.bin
8b5e323c10f660b6dd1e4ed819e046daddcfaf1f4ebbbede2ef8afec69055613		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B69 4076 bytes
font_02_sfnt_off0000992f.bin
6fd7c7f447d66842f81aa8cf197935b17f22157d0c7e9f95622df1b5b4ddf530		 pdf-font-stream PDF embedded font (sfnt) at offset 0x992F 2788 bytes
font_03_sfnt_off0000a31e.bin
4ed86f500da5b221f2e83bbf50b9a95e6e4e647dd84dd10545afbd7c082aa46c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA31E 18084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.