Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcdb70b190d3629a…

MALICIOUS

PDF

45.0 KB Created: 2021-05-13 07:47:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: d7c2f253fec788f9f29c82fbd6302904 SHA-1: 46f7c04f124454b42a3d9e8560c3851b540573be SHA-256: fcdb70b190d3629a5f22aee1b4efea328388227d1e073c774c90cd0f0967bac2
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a fake CAPTCHA lure and a large number of external links, indicating a phishing or scam attempt. The document's content and embedded links suggest it is designed to trick users into visiting malicious websites, potentially for credential harvesting or to download further malware. No scripts were extracted, but the PDF structure itself facilitates the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9632

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/free-spins-coin-master-2021-today-game-hack
    • http://pengolahan.perpus.wima.ac.id/repository/free-links-for-coin-master_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/coin-master-free-gift-cards_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/coin-master-free-spins-no-generator_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/united-gaming-net-coin-master-hack_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/can-you-get-free-robux-on-roblox_GM431946152.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/is-there-any-tricks-or-working-hacks-for-coin-master_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/all-links-for-free-spins-coin-master_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/tiktok-minecraft-hacks_GM479516143.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/free-robux-no-survey-or-human-verification_GM431946152.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/how-to-earn-free-stars-on-coin-master_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/roblox-imagine_GM431946152.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/free-robux-today_GM431946152.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/free-coins-coin-master-daily_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/minecraft-pe-apk-download-free-015-0_GM479516143.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/robux-today_GM431946152.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/how-to-get-free-minecraft-alts_GM479516143.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/get-free-spins-for-coin-master_GM406889139.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/robuxy-com-free-robux_GM431946152.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/free-minecraft-realms-to-join_GM479516143.pdf
    • http://pengolahan.perpus.wima.ac.id/repository/coin-master-hack-tool-without-human-verification_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000495b.bin
96578da4198a67716d7536bf41cd1490726b3a7e95e234ea9dc48b10506bc264		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x495B 25032 bytes
font_01_sfnt_off0000821e.bin
601c50867a41b9362538ff18e5f9479a0f9badf698aaf1eb7e88469c11719db7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x821E 2920 bytes
font_02_sfnt_off00008c37.bin
fb34871543d4e589edaa7b6b6daea61d4b413826d533968c66bf721badb2f47c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C37 18644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.