Malicious PDF — malware analysis report

Static analysis result for SHA-256 eeb9f3e496adf49e…

MALICIOUS

PDF

44.4 KB Created: 2021-06-09 17:33:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 91cf5a3d0b127aab58ddc913def4e3b2 SHA-1: 2b83c1d0eec310587efe4bb807ab42778ad34618 SHA-256: eeb9f3e496adf49ed013f803ab725aba6bc1ce9cebbe60d7ac2d4246dccae4b4
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents a fake CAPTCHA or human verification prompt to deceive users into interacting with a malicious link. The embedded URL, https://netcdn.tw/app/431946152/free-robux-easy-human-verification-game-hack, likely leads to the download of a second-stage payload. While no scripts were directly extracted, the PDF structure and heuristics suggest an attempt to exploit user interaction for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-robux-easy-human-verification-game-hack
    • http://elektrofahrspass.de/images/coin-master-free-spins-link-blogspot-2021_GM406889139.pdf
    • http://elektrofahrspass.de/images/free-roblox-clothes-codes_GM431946152.pdf
    • http://elektrofahrspass.de/images/coin-master-free-coins-2021_GM406889139.pdf
    • http://elektrofahrspass.de/images/free-spins-and-coins-coin-master-2021-link_GM406889139.pdf
    • http://elektrofahrspass.de/images/free-roblox-accounts-dantdm_GM431946152.pdf
    • http://elektrofahrspass.de/images/is-minecraft-free-on-ps4_GM479516143.pdf
    • http://elektrofahrspass.de/images/tiktok-for-free_GM835599320.pdf
    • http://elektrofahrspass.de/images/coin-master-free-100-spin_GM406889139.pdf
    • http://elektrofahrspass.de/images/earn-robux-today_GM431946152.pdf
    • http://elektrofahrspass.de/images/how-to-hack-roblox-for-robux_GM431946152.pdf
    • http://elektrofahrspass.de/images/coin-master-spins-hack-2021_GM406889139.pdf
    • http://elektrofahrspass.de/images/minecraft-free-download-chromebook_GM479516143.pdf
    • http://elektrofahrspass.de/images/free-robux-without-verification-or-survey_GM431946152.pdf
    • http://elektrofahrspass.de/images/free-robux-no-human-verification-no-survey_GM431946152.pdf
    • http://elektrofahrspass.de/images/free-roblox-card_GM431946152.pdf
    • http://elektrofahrspass.de/images/roblox-land-free-robux_GM431946152.pdf
    • http://elektrofahrspass.de/images/free-robux-rewards_GM431946152.pdf
    • http://elektrofahrspass.de/images/hack-coin-master-1_GM406889139.pdf
    • http://elektrofahrspass.de/images/coin-master-free-spin-and-coin-links_GM406889139.pdf
    • http://elektrofahrspass.de/images/free-mods-for-minecraft-pe_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000050d1.bin
ebfc52ce5c69db6a05b311c811b760cd8d8e775a5ec6e9fc63eaadb415c0d1f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50D1 24908 bytes
font_01_sfnt_off000088bf.bin
b2b17d3c8deabf5f43850becfc5508fb6f281a754377732f4bbf8fae145e1aa8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88BF 19040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.