Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa58859fc8ce5f76…

MALICIOUS

PDF

38.2 KB Created: 2021-05-22 14:06:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c95478a4471a57261e8cef13d1ad2cee SHA-1: 231050c30c3179be5e971c984ebca6714718c18e SHA-256: fa58859fc8ce5f769c2a1455be69da3324f5c0fe9dfbaf65e257ebd23c29429e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a lure for a "Free Robux Generator" and displays a fake CAPTCHA to trick the user into interacting with it. It embeds multiple URLs, some of which point to other PDF files hosted on suspicious domains, likely serving as downloaders or further lures. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9407

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-generator-no-human-verification-2021-game-hack
    • http://progressgel.ru/images/gamehunters-coin-master_GM406889139.pdf
    • http://progressgel.ru/images/coin-master-free-stuff_GM406889139.pdf
    • http://progressgel.ru/images/free-robux-mobile_GM431946152.pdf
    • http://progressgel.ru/images/classic-minecraft-net-hacks_GM479516143.pdf
    • http://progressgel.ru/images/coin-master-free-coins-and-spins-online-tool_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000312a.bin
260b78c8880ef40fc25a68f3da5e74fe48ad2de2116fd701f194ddf90d2ae7ce		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x312A 27964 bytes
font_01_sfnt_off00007100.bin
cfeb00e99c7da41c79bd6814c2de1bf58f441159bdfe452787b9448ffd27beb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7100 19260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.