PDF malware analysis — malicious · 1ee0d035c9734dd4

MALICIOUS

PDF

42.7 KB Created: 2021-05-10 16:01:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 53c4eed743e0fa2dd604929cb544bfac SHA-1: 84d6e95400b5c557f63540e33eaddf960e7c5675 SHA-256: 1ee0d035c9734dd450509ef8d23145cb4972fa3830b73befe7ab6fe5d56aecc4

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF document contains embedded URLs and a call-to-action phrase, indicating a social engineering attempt to trick the user into clicking a link. The heuristic 'SE_CLICKFIX' specifically suggests the document instructs the user to run a command, likely to bypass security measures and download a secondary payload. The ML classifier also strongly flags this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

ClickFix social engineering attack high SE_CLICKFIX

Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/best-minecraft-hacks-game-hack
- http://perpus.masda.ac.id//repository/coin-master-free-spins-2021_GM406889139.pdf
- http://perpus.masda.ac.id/repository/wahoogaming-co-free-robux_GM431946152.pdf
- http://perpus.masda.ac.id//repository/coin-master-free-blogspot_GM406889139.pdf
- http://perpus.masda.ac.id/repository/coin-master-free-2021-spin-link_GM406889139.pdf
- http://perpus.masda.ac.id/repository/free-robux-without-verification-2021_GM431946152.pdf
- http://perpus.masda.ac.id/repository/code-free-robux_GM431946152.pdf
- http://perpus.masda.ac.id//repository/master-coin-hack-apk_GM406889139.pdf
- http://perpus.masda.ac.id//repository/coin-master-links-for-today_GM406889139.pdf
- http://perpus.masda.ac.id/repository/roblox-data-breach_GM431946152.pdf
- http://perpus.masda.ac.id/repository/coin-master-free-spins-facebook_GM406889139.pdf
- http://perpus.masda.ac.id//repository/how-to-find-coin-master-free-spin-link_GM406889139.pdf
- http://perpus.masda.ac.id/repository/robloxbux-us-generator_GM431946152.pdf
- http://perpus.masda.ac.id/repository/easy-robux_GM431946152.pdf
- http://perpus.masda.ac.id//repository/coin-master-app_GM406889139.pdf
- http://perpus.masda.ac.id//repository/how-to-get-free-robux-app_GM431946152.pdf
- http://perpus.masda.ac.id/repository/coin-master-free-spins-2021-blogspot_GM406889139.pdf
- http://perpus.masda.ac.id/repository/coin-master-spin-hack-app_GM406889139.pdf
- http://perpus.masda.ac.id/repository/free-minecraft-worlds_GM479516143.pdf
- http://perpus.masda.ac.id//repository/free-robux-generator-2021_GM431946152.pdf
- http://perpus.masda.ac.id//repository/minecraft-pocket-edition-mods-for-free_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004b9e.bin` `f8077845c94144d080fedfa5b06cb41c010f5d97728bd4fb059ad56e67b5dfbb`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4B9E	25616 bytes
`font_01_sfnt_off000085d3.bin` `6dfee1982b58ab3489cc821793519200b658269375d8b02cd788103d93863fb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x85D3	17952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.