PDF malware analysis — malicious · db74e8dae13d3863

MALICIOUS

PDF

42.9 KB Created: 2021-05-14 05:37:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 34152de41e2b1115b718fd70139ac246 SHA-1: ecf38c287b7a4b2006e3009da256c895f0588611 SHA-256: db74e8dae13d386325c6093d830cb518a9179f50dc1ea5bec41f50e05bb0609f

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a fake CAPTCHA lure, aiming to trick users into clicking embedded links. The primary malicious URL identified is https://netcdn.xyz/app/431946152/free-2021-robux-game-hack, which likely serves as a download or redirection point for further malicious activity. The document's structure and content suggest it's part of a phishing or scam campaign.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-2021-robux-game-hack
- http://briankellyforcongress.com/images/is-it-possible-to-get-free-robux_GM431946152.pdf
- http://briankellyforcongress.com/images/free-coins-coin-master-2021_GM406889139.pdf
- http://briankellyforcongress.com/images/coin-master-daily-free-spins-link-haktuts_GM406889139.pdf
- http://briankellyforcongress.com/images/300-free-spins-coin-master_GM406889139.pdf
- http://briankellyforcongress.com/images/free-robux-no-anti-bot-verification_GM431946152.pdf
- http://briankellyforcongress.com/images/get-free-robux-gg_GM431946152.pdf
- http://briankellyforcongress.com/images/free-robux-hack_GM431946152.pdf
- http://briankellyforcongress.com/images/how-to-get-free-robux-website_GM431946152.pdf
- http://briankellyforcongress.com/images/monttechscom-coin-master-free-spins_GM406889139.pdf
- http://briankellyforcongress.com/images/roebucks-on-roblox_GM431946152.pdf
- http://briankellyforcongress.com/images/coin-master-free-coins-and-spins-2021_GM406889139.pdf
- http://briankellyforcongress.com/images/free-pet-food-coin-master_GM406889139.pdf
- http://briankellyforcongress.com/images/sites-to-get-free-robux_GM431946152.pdf
- http://briankellyforcongress.com/images/how-to-get-free-chest-in-coin-master_GM406889139.pdf
- http://briankellyforcongress.com/images/how-can-you-get-free-robux_GM431946152.pdf
- http://briankellyforcongress.com/images/free-coins-and-spins-for-coin-master_GM406889139.pdf
- http://briankellyforcongress.com/images/rbxcity-free-robux_GM431946152.pdf
- http://briankellyforcongress.com/images/coin-master-free-spins-2021_GM406889139.pdf
- http://briankellyforcongress.com/images/coin-master-free-coins-and-spins-hack_GM406889139.pdf
- http://briankellyforcongress.com/images/www-coinmaster-com_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000047b9.bin` `909c86576d0fc2a66cb37e352635b4a0e3ad72845aed3995b7aa2bbb9abaa826`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47B9	26700 bytes
`font_01_sfnt_off000084da.bin` `24dd33113ad1920a4b79572916f2875f9d05bd64d95cc44e0cd438e20c1ad4df`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x84DA	18416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.