PDF malware analysis — malicious · ffa6868c65df207f

MALICIOUS

PDF

48.8 KB Created: 2021-06-07 12:05:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: ab52aafd144a2fa7d8cb0881109741f1 SHA-1: 3ad31efd809e565d9630b869768ebf9799e09374 SHA-256: ffa6868c65df207f2be0031fa4f67e743d4f42550ac69b7e97af7c618cdd2e80

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a fake CAPTCHA lure, designed to trick users into interacting with a malicious link. The embedded URL, https://netcdn.tw/app/431946152/cheat-codes-for-roblox-prison-life-2.0-game-hack, likely leads to a second-stage payload or phishing page. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9796

Heuristics 4

Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA

Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/cheat-codes-for-roblox-prison-life-2.0-game-hack
- http://www.homesweethome.pl/images/coin-master-free-2021-spin-link_GM406889139.pdf
- http://www.homesweethome.pl/images/roblox-hack-unlimited-robux_GM431946152.pdf
- http://www.homesweethome.pl/images/free-robux-that-actually-works_GM431946152.pdf
- http://www.homesweethome.pl/images/coin-master-links-that-don-t-expire_GM406889139.pdf
- http://www.homesweethome.pl/images/minecraft-pe-hacks_GM479516143.pdf
- http://www.homesweethome.pl/images/free-robux-today_GM431946152.pdf
- http://www.homesweethome.pl/images/coin-master-hack-spins-apk-download_GM406889139.pdf
- http://www.homesweethome.pl/images/free-robux-on-ipad_GM431946152.pdf
- http://www.homesweethome.pl/images/coin-master-free-spin-trick_GM406889139.pdf
- http://www.homesweethome.pl/images/daily-coin-master-spins_GM406889139.pdf
- http://www.homesweethome.pl/images/roblox-com-robux_GM431946152.pdf
- http://www.homesweethome.pl/images/free-robux-easy_GM431946152.pdf
- http://www.homesweethome.pl/images/is-minecraft-education-edition-free_GM479516143.pdf
- http://www.homesweethome.pl/images/get-free-robux-without-human-verification_GM431946152.pdf
- http://www.homesweethome.pl/images/coin-master-apk-hacked-3526_GM406889139.pdf
- http://www.homesweethome.pl/images/free-robux-2021-no-survey_GM431946152.pdf
- http://www.homesweethome.pl/images/free-spins-and-coins-coin-master-2021-link_GM406889139.pdf
- http://www.homesweethome.pl/images/how-to-get-minecraft-java-edition-for-free_GM479516143.pdf
- http://www.homesweethome.pl/images/roblox-mobile-hack_GM431946152.pdf
- http://www.homesweethome.pl/images/minecraft-mods-download-free_GM479516143.pdf
- https://discord
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005402.bin` `0af704500074865ab2534204a20ff923575a58aad9a8dac63c8012faf74ae609`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5402	25904 bytes
`font_01_sfnt_off00008efc.bin` `eb230542719c96b42e3fd8bb01e35f13ebd5f02629049da3a58e7fd7607bf48a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8EFC	2940 bytes
`font_02_sfnt_off0000990b.bin` `6b6e123920d1ef45b8b573e49fa711f53e5938ff88bb01b9f4d20c86e049d665`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x990B	19256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.