PDF malware analysis — malicious · 33389d919c62d241

MALICIOUS

PDF

42.3 KB Created: 2021-05-16 23:10:29 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 2ba13912c5fd5fd5ebef583d5d829f6d SHA-1: 000e3f40dada56c97c86a69e2dd95e0cd2546ff8 SHA-256: 33389d919c62d2413b7471a854fbfd8a518e1d63786de87652a438467ab95cd3

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains a prominent link to a suspicious URL, identified as a potential social engineering attack (ClickFix). The ML classifier also flagged this PDF as malicious. The presence of multiple links to similar-themed sites suggests a phishing or scam attempt designed to trick users into visiting potentially harmful websites.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

ClickFix social engineering attack high SE_CLICKFIX

Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/best-free-minecraft-servers-game-hack
- https://datavoiz.com/images/huskybuckscom-free-robux_GM431946152.pdf
- https://datavoiz.com/images/free-roblox-app_GM431946152.pdf
- https://datavoiz.com/images/robux-for-surveys_GM431946152.pdf
- https://datavoiz.com/images/free-robux-that-actually-works_GM431946152.pdf
- https://datavoiz.com/images/how-to-get-free-robux-without-verification-2021_GM431946152.pdf
- https://datavoiz.com/images/get-free-robux_GM431946152.pdf
- https://datavoiz.com/images/coin-master-daily-spin-link-app_GM406889139.pdf
- https://datavoiz.com/images/where-can-i-get-free-spins-for-coin-master_GM406889139.pdf
- https://datavoiz.com/images/roblox-earn-robux_GM431946152.pdf
- https://datavoiz.com/images/coin-master-link-spin_GM406889139.pdf
- https://datavoiz.com/images/free-spins-and-coins-coin-master-facebook_GM406889139.pdf
- https://datavoiz.com/images/free-robux-survey_GM431946152.pdf
- https://datavoiz.com/images/how-can-i-get-free-robux_GM431946152.pdf
- https://datavoiz.com/images/minecraft-apk-download-free-11-055_GM479516143.pdf
- https://datavoiz.com/images/free-robux-codes-2021_GM431946152.pdf
- https://datavoiz.com/images/free-robux-mobile_GM431946152.pdf
- https://datavoiz.com/images/coin-master-card-collection-hack_GM406889139.pdf
- https://datavoiz.com/images/how-do-you-get-free-robux-without-doing-anything_GM431946152.pdf
- https://datavoiz.com/images/free-coin-master-stuff_GM406889139.pdf
- https://datavoiz.com/images/coin-master-tricks_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004b42.bin` `01bcd062c4f1d4d8a8c5f73e1ef1c7803763ffde4296348e6235ec2fbd6e50fa`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4B42	24772 bytes
`font_01_sfnt_off0000844c.bin` `c529f757d6b4a4f9c7840ecb5b6035c813da3045ee3b560268268dab20db1aa9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x844C	17896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.