PDF malware analysis — malicious · d8d68022fc1503e5

MALICIOUS

PDF

49.5 KB Created: 2021-06-03 07:01:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: c3c327d86667f0a85da7c4ca2163e5cc SHA-1: 42df548be3baea88b15576ecbd1a86ffe0fe9356 SHA-256: d8d68022fc1503e5d68202a1a06a40dc47f4acd77e1240b307288c8d96e48fa0

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents itself as a lure for 'Free Robux' and displays a fake CAPTCHA or human verification prompt to trick the user. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a malicious payload. The ML classifier also flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9796

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.online/app/431946152/free-robux-no-human-verification-or-survey-or-download-2021-game-hack
- http://librarysenior.com/repository/free-minecraft-java-edition-codes_GM479516143.pdf
- http://librarysenior.com/repository/coin-master-gold-cards-hack_GM406889139.pdf
- http://librarysenior.com//repository/earn-robux-today-earn-robux-today_GM431946152.pdf
- http://librarysenior.com/repository/free-minecraft-accounts-2021_GM479516143.pdf
- http://librarysenior.com/repository/minecraft-free-edition_GM479516143.pdf
- http://librarysenior.com/repository/legit-free-spins-coin-master_GM406889139.pdf
- http://librarysenior.com/repository/coin-master-32-android-mod-hack-apk-download_GM406889139.pdf
- http://librarysenior.com//repository/best-minecraft-hacked-client_GM479516143.pdf
- http://librarysenior.com//repository/how-to-get-free-robux-without-surveys_GM431946152.pdf
- http://librarysenior.com//repository/how-to-get-minecraft-windows-10-edition-for-free_GM479516143.pdf
- http://librarysenior.com/repository/free-robux-no-survey-or-human-verification_GM431946152.pdf
- http://librarysenior.com/repository/play-minecraft-pocket-edition-for-free_GM479516143.pdf
- http://librarysenior.com//repository/rbx-free-robux_GM431946152.pdf
- http://librarysenior.com/repository/robuxglobalcom_GM431946152.pdf
- http://librarysenior.com//repository/no-human-verification-coin-master-hack_GM406889139.pdf
- http://librarysenior.com//repository/coin-master-hacks-xyz_GM406889139.pdf
- http://librarysenior.com//repository/20-free-spins-coin-master_GM406889139.pdf
- http://librarysenior.com//repository/toolbox-for-minecraft-pe_GM479516143.pdf
- http://librarysenior.com/repository/free-roblox-acc_GM431946152.pdf
- http://librarysenior.com//repository/free-coin-master-cards-link_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000530b.bin` `ffa28bb296120cd6766669d4d1caf85951f4b3da440bdb8d6c8c2e2d1ff75249`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x530B	25620 bytes
`font_01_sfnt_off00008ed5.bin` `63aa1324eea2596d97c053612205c875310fc09f6ccd1c31fdd002fbadf38d44`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8ED5	3016 bytes
`font_02_sfnt_off00009939.bin` `66e5e50e12f5eb49621ab9bcd6ab85026409d616512a452c1eb3339dd9867554`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9939	20136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.