Malicious PDF — malware analysis report

Static analysis result for SHA-256 014464edef392bb0…

MALICIOUS

PDF

46.3 KB Created: 2021-05-16 22:36:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 5b39af21438734a42b9a85f6f0926c03 SHA-1: b2403b47b3c2e08d59a72c4cfb54a2ba68f0619a SHA-256: 014464edef392bb0fd1a558a36bb7af653ac7e03a4d51ff90511d1ac1be9e2d3
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF document employs social engineering tactics, specifically a 'ClickFix' lure, to trick users into executing commands. The document body and embedded URLs promote fake game hacks and free accounts, aiming to entice users to download further malicious content. The heuristic firings indicate the document is designed to bypass macro restrictions by instructing users to manually run commands, likely leading to the download and execution of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9278

Heuristics 5

  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/get-free-minecraft-account-game-hack
    • http://www.himalassociation.org/himal/ck_image/files/free-spins-for-coin-master-2021_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-hack-version-33-2_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-free-link-spin_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/minecraft-hacked-apk_GM479516143.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-in-app-purchase-hack_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/haktuts-coin-master-free-spin-link_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-free-spins-link-2021_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/best-free-robux-sites_GM431946152.pdf
    • http://www.himalassociation.org/himal/ck_image/files/roblox-printables-free_GM431946152.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-free-gifts_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/roblox-avatar-free_GM431946152.pdf
    • http://www.himalassociation.org/himal/ck_image/files/8bp-hack-coin-master_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/robux-match_GM431946152.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-daily-free-spins-and-coins_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/free-robux-codes-2021-real_GM431946152.pdf
    • http://www.himalassociation.org/himal/ck_image/files/free-minecraft-mods_GM479516143.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-free-spins-hack-iphone_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/how-to-get-free-robux-without-downloading-apps-2021_GM431946152.pdf
    • http://www.himalassociation.org/himal/ck_image/files/coin-master-gameplay_GM406889139.pdf
    • http://www.himalassociation.org/himal/ck_image/files/how-to-really-hack-coin-master_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004efd.bin
7500bffbdaeb4d1c92fdd6716f4a8035f123678f298bbc8aaf26df0a0da650bf		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4EFD 25244 bytes
font_01_sfnt_off000088de.bin
a21c0cf31f452bfc714670a671cd4ddbec58d97e7bc066c46099de8e778306b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88DE 3156 bytes
font_02_sfnt_off000093c9.bin
6ca58bbc5c252d5e4a1aca958c959d63db43c13a52b94ea2f1ea4654af3c8c31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93C9 17848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.