Malicious PDF — malware analysis report

Static analysis result for SHA-256 fca402c268345762…

MALICIOUS

PDF

45.1 KB Created: 2021-06-10 23:19:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 2b70da8589c6a7fbdda9d707955f2d97 SHA-1: f9a006b93207678d00daea906f32538629bd928c SHA-256: fca402c26834576255f02c287d494e3b72baadeb86beb8c938eafca27abc30c1
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents a fake CAPTCHA lure to trick the user into interacting with it, likely to initiate a download. The embedded URL points to a resource that appears to be related to game exploits, further supporting a malicious intent. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/youyube-how-to-get-free-robux-that-working-game-hack
    • https://art-concept.gr/images/how-to-bypass-key-systems-on-roblox-cheats_GM431946152.pdf
    • https://art-concept.gr/images/roblox-working-strucid-aimbot-hack-2021-august-pastebin_GM431946152.pdf
    • https://art-concept.gr/images/how-to-get-free-robux-2021-december_GM431946152.pdf
    • https://art-concept.gr/images/is-hacking-robux-impossible_GM431946152.pdf
    • http://www.art-concept.gr/images/optifine-mcpe_GM479516143.pdf
    • http://www.art-concept.gr/images/robux-fun-hack_GM431946152.pdf
    • https://art-concept.gr/images/free-roblox-exploits-loadstring_GM431946152.pdf
    • http://www.art-concept.gr/images/free-robux-2021_GM431946152.pdf
    • http://www.art-concept.gr/images/how-to-get-free-robux-instantly_GM431946152.pdf
    • http://www.art-concept.gr/images/roblox-free-robux-website_GM431946152.pdf
    • https://art-concept.gr/images/roblox-sharkbite-hack-script-pastebin_GM431946152.pdf
    • https://art-concept.gr/images/how-to-hack-death-run-roblox-cheat-engine-2021_GM431946152.pdf
    • https://art-concept.gr/images/free-robux-extensions_GM431946152.pdf
    • http://www.art-concept.gr/images/roblox-promo-code-to-get-free-robux_GM431946152.pdf
    • http://www.art-concept.gr/images/roblox-free-items-glitch_GM431946152.pdf
    • http://www.art-concept.gr/images/free-robux-hacker-us_GM431946152.pdf
    • https://art-concept.gr/images/robux-hack-no-human-verification-no-survey_GM431946152.pdf
    • http://www.art-concept.gr/images/old-roblox-accounts-for-free_GM431946152.pdf
    • http://www.art-concept.gr/images/free-spins-for-coin-master-game_GM406889139.pdf
    • http://www.art-concept.gr/images/coin-master-daily-free-spins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051c6.bin
6b05656d6f386b89f84984ec0ea247599aaf0c0809c7bd41b9cdb08b7f8200d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51C6 25092 bytes
font_01_sfnt_off00008904.bin
3ce81ef10ecb498fc4db64fb377cf24d54407c8b907c37ead3ae04c41c96aaad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8904 19792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.