PDF malware analysis — malicious · d82ea2a5826b75bd

MALICIOUS

PDF

42.2 KB Created: 2021-05-14 15:13:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: a623ef417a202a73f2a7751d1887d4b4 SHA-1: 52a2a3c5ca20f5c868eaa0617c4113aa08b8e79d SHA-256: d82ea2a5826b75bd8b50494d7fda939278f62a1f03d754bbf22cd7495516eecf

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a fake CAPTCHA lure to trick users into interacting with the document, likely leading to a download or redirection. It also contains multiple embedded URLs pointing to potentially malicious sites offering game-related cheats or hacks. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/minecraft-on-computer-free-game-hack
- https://happypipers.ch/images/get-me-robux-for-free_GM431946152.pdf
- https://happypipers.ch/images/free-spin-link-for-coin-master-game_GM406889139.pdf
- https://happypipers.ch/images/roblox-free-bundles_GM431946152.pdf
- https://happypipers.ch/images/free-game-pack-with-google-play-coin-master_GM406889139.pdf
- https://happypipers.ch/images/how-do-u-hack-roblox_GM431946152.pdf
- https://happypipers.ch/images/coin-master-hack-version-download-2021-ios_GM406889139.pdf
- https://happypipers.ch/images/hey-google-how-do-you-get-free-robux_GM431946152.pdf
- https://happypipers.ch/images/roblox-hack-tool_GM431946152.pdf
- https://happypipers.ch/images/coin-master-hack-no-verification-ios_GM406889139.pdf
- https://happypipers.ch/images/blogspot-coin-master-spins_GM406889139.pdf
- https://happypipers.ch/images/how-to-get-free-robux-without-offers_GM431946152.pdf
- https://happypipers.ch/images/coin-master-free-in-app-purchases-jailbreak_GM406889139.pdf
- https://happypipers.ch/images/coin-master-free-spins-usa-2021_GM406889139.pdf
- https://happypipers.ch/images/free-robux-generator-com-roblox-hack_GM431946152.pdf
- https://happypipers.ch/images/how-to-get-free-spins-grom-coin-master_GM406889139.pdf
- https://happypipers.ch/images/roblox-hack-ga_GM431946152.pdf
- https://happypipers.ch/images/free-robux-2021-no-verification_GM431946152.pdf
- https://happypipers.ch/images/how-can-i-get-free-coinsn-coin-master_GM406889139.pdf
- https://happypipers.ch/images/how-to-get-free-robux-on-roblox-2021_GM431946152.pdf
- https://happypipers.ch/images/spin-free-coin-master_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004ac2.bin` `608b491dae56631846c3702d0b2a43cf466c1c6599217a1313c972d09decb86a`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4AC2	24548 bytes
`font_01_sfnt_off000082e5.bin` `ce17ca81234478eae2e4d5d82743db6ecf39d6315d037818deed1e54c2e5b17b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x82E5	18284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.