Malicious PDF — malware analysis report

Static analysis result for SHA-256 f04cba3aa38a0ba3…

MALICIOUS

PDF

45.6 KB Created: 2021-06-11 06:57:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: bd941f5e5239b68bbbcb5f040294b738 SHA-1: 89bebea8688b457fe4923baa66bfca31be617145 SHA-256: f04cba3aa38a0ba397a4294f3300675fc3ce7c567aabd2fc73bee97f82af7d52
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The sample presents a fake CAPTCHA, a common lure to trick users into interacting with the document. It contains an external URI pointing to a URL that likely hosts a malicious payload. The document body, though partially corrupted, contains URLs related to game exploits and cheats, reinforcing the lure. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/boku-no-roblox-free-vip-server-game-hack PDF link annotation
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/roblox-exploit-download_GM431946152.pdfIn PDF document text
    • https://bbalitvet.litbang.pertanian.go.id/library/repository/play-minecraft-for-free_GM479516143.pdfIn PDF document text
    • https://bbalitvet.litbang.pertanian.go.id/library/repository/roblox-a-bizzare-day-cheats_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/free-robux-scams_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/how-to-make-a-group-on-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/coin-master-daily-gift-free-spins-and-coins-link-today_GM406889139.pdfIn PDF document text
    • https://bbalitvet.litbang.pertanian.go.id/library/repository/roblox-sunset-city-money-hack_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/free-safe-ways-to-get-robux-in-roblox_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/coin-master-spin-hack_GM406889139.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/roblox-all-free-stuff_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/show-me-how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/roblox-www-com_GM431946152.pdfIn PDF document text
    • https://bbalitvet.litbang.pertanian.go.id/library/repository/website-roblox-cheat-new_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/minecraft-pe-apk-free-download_GM479516143.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/codes-how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/free-robux-gift-card-generator_GM431946152.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/coin-master-unlimited-spin-and-coin-hack_GM406889139.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/impact-minecraft-hack_GM479516143.pdfIn PDF document text
    • https://bbalitvet.litbang.pertanian.go.id/library/repository/how-to-hack-minecraft_GM479516143.pdfIn PDF document text
    • http://bbalitvet.litbang.pertanian.go.id/library/repository/coin-master-free-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000512f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x512F 26072 bytes
SHA-256: 1bb2acb7d2d1e7ce517dac06dc10009ec25a31850ec0a850ceb4f9a31993b4ce
font_01_sfnt_off00008e3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E3A 18800 bytes
SHA-256: e229e3b27d0dfdcef8d9961fa34bcc4d8d317fda287ce3613d11acba4af14d24

Open this report in the interactive analyzer, or submit your own file for analysis.