Malicious PDF — malware analysis report

Static analysis result for SHA-256 f529bdf4ca44d079…

MALICIOUS

PDF

48.9 KB Created: 2021-06-03 13:51:21 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c9152c2a48bd6f4b6676c00327b40429 SHA-1: 03777229eb240a8c3be8f8bc0091de3f8edf001d SHA-256: f529bdf4ca44d07944c80545cacedffadd67a56f812734569db795c817f087f9
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a fake CAPTCHA lure, a common social engineering tactic to trick users into interacting with malicious content. It also embeds external URLs, one of which is directly linked to a potential malware download. The presence of these elements strongly suggests a malicious intent to deliver a payload or redirect the user to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/free-spins-coin-master-haktuts-game-hack
    • http://www.library.gkigadingserpong.org/repository/www-roblox-com-robux_GM431946152.pdf
    • http://library.gkigadingserpong.org/repository/roblox-free-clothes-hack_GM431946152.pdf
    • http://www.library.gkigadingserpong.org/repository/how-to-get-free-robux-without-paying_GM431946152.pdf
    • http://library.gkigadingserpong.org/repository/free-spins-coin-master-hack-2021_GM406889139.pdf
    • http://library.gkigadingserpong.org/repository/hack-to-protect-village-on-coin-master_GM406889139.pdf
    • http://library.gkigadingserpong.org/repository/hack-coin-master-for-free_GM406889139.pdf
    • http://library.gkigadingserpong.org/repository/coin-master-card-collection-hack-2021_GM406889139.pdf
    • http://library.gkigadingserpong.org/repository/free-spin-app-coin-master_GM406889139.pdf
    • http://www.library.gkigadingserpong.org/repository/how-to-get-free-robux-fast_GM431946152.pdf
    • http://library.gkigadingserpong.org/repository/get-free-robux-info_GM431946152.pdf
    • http://www.library.gkigadingserpong.org/repository/free-spin-codes-coin-master_GM406889139.pdf
    • http://library.gkigadingserpong.org/repository/xray-hack_GM479516143.pdf
    • http://library.gkigadingserpong.org/repository/redeem-roblox-card-free_GM431946152.pdf
    • http://www.library.gkigadingserpong.org/repository/roblox-sued_GM431946152.pdf
    • http://library.gkigadingserpong.org/repository/how-to-get-free-robux-in-2021_GM431946152.pdf
    • http://library.gkigadingserpong.org/repository/how-to-get-java-minecraft-free_GM479516143.pdf
    • http://library.gkigadingserpong.org/repository/play-minecraft-online-free_GM479516143.pdf
    • http://www.library.gkigadingserpong.org/repository/give-me-robux-now_GM431946152.pdf
    • http://www.library.gkigadingserpong.org/repository/minecraft-pe-free-apk_GM479516143.pdf
    • http://www.library.gkigadingserpong.org/repository/robloxbux-us-generator_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000052fa.bin
fad57e9caeaa22c00eddfd71448dacf152e594e94ebf080b5966d31cb1eec712		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x52FA 26656 bytes
font_01_sfnt_off00008f28.bin
0fe84ebe70be222df07057087ce95a09d88ac35246146b6b977534c6609658c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F28 3908 bytes
font_02_sfnt_off00009cd4.bin
fd8ee59660af8c9e4664936919e7b5321f93298eaf8e2ea805d6f2ae56b4a3b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CD4 18196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.