PDF malware analysis — malicious · f3aa50354575c3dd

MALICIOUS

PDF

42.4 KB Created: 2021-05-11 02:12:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 259bf05c2388f0bd6f3427a15e19922b SHA-1: 6bb483b4fcdc0e9f027c26adf3cf976ddb4159aa SHA-256: f3aa50354575c3ddb5fb2f6129174a0c6151bf5a75ceec53feb7d2e592d8a1c3

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a fake CAPTCHA lure, aiming to trick users into downloading a tool from the provided URL. The ML classifier also flagged this PDF as malicious with high confidence. The presence of numerous URLs related to game hacks and cheats suggests a social engineering campaign to distribute malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-hack-tool-v1-9-game-hack
- https://www.colditex.com/images/free-robux-for-kids-no-verification_GM431946152.pdf
- https://www.colditex.com/images/coin-master-free-spin-2912-2021_GM406889139.pdf
- https://www.colditex.com/images/roblox-hack-2021_GM431946152.pdf
- https://www.colditex.com/images/how-do-i-earn-robux_GM431946152.pdf
- https://www.colditex.com/images/free-robux-android_GM431946152.pdf
- https://www.colditex.com/images/minecraft-hacked-client-download_GM479516143.pdf
- https://www.colditex.com/images/robloxbux-us-generator_GM431946152.pdf
- https://www.colditex.com/images/free-robux-no-verify-2021_GM431946152.pdf
- https://www.colditex.com/images/coin-master-heaven-free-spins_GM406889139.pdf
- https://www.colditex.com/images/gain-robux_GM431946152.pdf
- https://www.colditex.com/images/coin-master-daily-spin-link-app_GM406889139.pdf
- https://www.colditex.com/images/how-to-get-free-robux-without-downloading-any-apps_GM431946152.pdf
- https://www.colditex.com/images/free-robux-only-username_GM431946152.pdf
- https://www.colditex.com/images/roblox-but_GM431946152.pdf
- https://www.colditex.com/images/how-to-get-stuff-that-cost-coins-free-mcpe-master_GM406889139.pdf
- https://www.colditex.com/images/does-roblox-premium-expire_GM431946152.pdf
- https://www.colditex.com/images/coin-master-card-collection-hack-2021_GM406889139.pdf
- https://www.colditex.com/images/can-i-get-robux-for-free_GM431946152.pdf
- https://www.colditex.com/images/coin-master-free-spins_GM406889139.pdf
- https://www.colditex.com/images/roblox-mobile-hack_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000048c5.bin` `29efc97ecb3aa95c97d6a3fa46304e421d3b9689e52a22fa59c7a7d209a941f0`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x48C5	25564 bytes
`font_01_sfnt_off0000839c.bin` `948bfbd28f908060b86a9c4a078f031a0a7b6f349e372fe1328e9069b1b47d5a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x839C	18196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.