Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc1da2309d7898fd…

MALICIOUS

PDF

47.2 KB Created: 2021-05-19 00:45:31 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 6847244323f3a25e34ebbf5d3b5b8862 SHA-1: 52d758f1a4243da696f0f852a236e94f63cafe8b SHA-256: dc1da2309d7898fd35e8e8743bd2fd94de50657824467d4f6fc3b792a1ef47c5
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document displays a fake CAPTCHA to lure users into clicking a link, which is a common social engineering tactic. The embedded URL and numerous other URLs found in the document point to potentially malicious content, likely a second-stage payload or phishing site. No scripts were extracted, limiting further analysis of direct execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8948

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-make-roblox-clothes-for-free-game-hack
    • http://library.asih-husada.ac.id/repository/how-to-get-free-robux-without-doing-anything-2021_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/coin-master-ad_GM406889139.pdf
    • http://library.asih-husada.ac.id/repository/robuxmatch-com-free-robux_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/roblox-sexually_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/coin-master-free-gold-cards-link-2021ee-spins_GM406889139.pdf
    • http://library.asih-husada.ac.id/repository/hack-coin-master-free_GM406889139.pdf
    • http://library.asih-husada.ac.id/repository/free-robux-picture_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/minecraft-hacks-ps4_GM479516143.pdf
    • http://library.asih-husada.ac.id/repository/coin-master-daily-free-spins-link-today-2021_GM406889139.pdf
    • http://library.asih-husada.ac.id/repository/jailbreak-roblox-hack_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/free-2021-robux_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/roblox-gift-card-online-free_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/how-to-hack-roblox-to-get-free-robux_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/how-to-get-minecraft-pe-for-free_GM479516143.pdf
    • http://library.asih-husada.ac.id/repository/get-free-robux-now_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/free-robux-app-2021_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/how-to-get-minecraft-for-free-on-xbox-360_GM479516143.pdf
    • http://library.asih-husada.ac.id/repository/free-robux-without-human-verification-2021_GM431946152.pdf
    • http://library.asih-husada.ac.id/repository/mcmaster-club-coin-master-hack_GM406889139.pdf
    • http://library.asih-husada.ac.id/repository/free-spins-link-in-coin-master-2021_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004b09.bin
a2ae8e07f4b2e14f8dac6c0fa9bbb5804acfd5053604951944455554461072a1		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B09 27144 bytes
font_01_sfnt_off00008aa3.bin
a66b570a908761b39e6d9e18bcb667c353840a86c6a7db528f79d01abe6b23a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8AA3 2844 bytes
font_02_sfnt_off0000944a.bin
75869b94c2b17b25dac59f0b0f7f9ff270f85e9e7170da1a335b6396ed3bda83		 pdf-font-stream PDF embedded font (sfnt) at offset 0x944A 18976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.