Malicious PDF — malware analysis report

Static analysis result for SHA-256 49dcf11ff1b75d2d…

MALICIOUS

PDF

43.7 KB Created: 2021-05-15 00:37:45 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c84aad1e4dd756a3c03192d651f67384 SHA-1: e79e1996171a8feb66780fbc74bb314c8bfe8afc SHA-256: 49dcf11ff1b75d2d97cc887c0159ee6e440e4d9799b68bd12a6b7907d756a288
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a malicious link disguised as a download for a Minecraft server hack, a common lure for social engineering attacks. The SE_CLICKFIX heuristic indicates the document likely instructs the user to execute a command or open a link, further supporting a malicious intent to trick the user into visiting a potentially harmful URL. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/free-minecraft-java-server-game-hack
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/coin-master-332-apk-free-download_GM406889139.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/coin-master-hack-tool-v1-9-download-free_GM406889139.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/free-robux-no-apps_GM431946152.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/coin-master-hack-2021-apk-download_GM406889139.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/coin-master-free-spin-and-coin-links_GM406889139.pdf
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/robux-survey_GM431946152.pdf
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/how-to-get-roblox-premium-for-free-2021_GM431946152.pdf
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/free-coin-master-spins_GM406889139.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/free-robux-that-actually-works-2021_GM431946152.pdf
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/free-robux-pins_GM431946152.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/cm-daily-spins_GM406889139.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/earn-points-for-robux_GM431946152.pdf
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/how-to-get-free-roblox-items_GM431946152.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/coin-master-gold-cards-free_GM406889139.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/rich-free-roblox-accounts_GM431946152.pdf
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/coin-master-hack-mod_GM406889139.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/win-free-robux_GM431946152.pdf
    • http://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/rblx-city-free-robux_GM431946152.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/worst-client_GM479516143.pdf
    • https://elearning.hidayatussalam.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-generator_GM431946152.pdf
    • https://youtu
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004d73.bin
01ea9c06eb32d1c14fec5b11b84d2a0d1e6edfe46be70bc64ad6a8d44ee22f00		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4D73 26436 bytes
font_01_sfnt_off00008a30.bin
c817850addb7f4586eab0926175a8ce7be5c169962767968ade405e83d703cb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A30 17848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.