PDF malware analysis — malicious · 5702a08148e803b4

MALICIOUS

PDF

44.8 KB Created: 2021-05-17 03:41:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 0ff756f5276c2fd1dfc536b274e3018c SHA-1: 7005058dd7ab81d4778cc32b60b26dc7af9ad1ac SHA-256: 5702a08148e803b420581ea21716afcd13cffb573d4268e801535f965528317a

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF document exhibits social engineering tactics, specifically a "ClickFix" lure, by instructing the user to execute a command. This is intended to bypass security measures and trick the user into downloading or running malicious content, as indicated by the embedded URL pointing to a "hacks" download. The ML classifier also flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9632

Heuristics 4

ClickFix social engineering attack high SE_CLICKFIX

Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/best-minecraft-hacks-game-hack
- https://www.campguru.co.za/images/free-roblox-clothes_GM431946152.pdf
- https://www.campguru.co.za/images/coin-master-hack-spins_GM406889139.pdf
- https://www.campguru.co.za/images/roblox-free-executor_GM431946152.pdf
- https://www.campguru.co.za/images/minecraft-modded-client_GM479516143.pdf
- https://www.campguru.co.za/images/how-to-get-free-robux-without-any-verification_GM431946152.pdf
- https://www.campguru.co.za/images/coin-master-hack-no-download_GM406889139.pdf
- https://www.campguru.co.za/images/minecraft-free-reddit_GM479516143.pdf
- https://www.campguru.co.za/images/coin-master-hack-tool-generator_GM406889139.pdf
- https://www.campguru.co.za/images/coin-master-hack-version-33-2_GM406889139.pdf
- https://www.campguru.co.za/images/free-coin-master-stuff_GM406889139.pdf
- https://www.campguru.co.za/images/free-spins-coin-master-ios-links_GM406889139.pdf
- https://www.campguru.co.za/images/coin-master-hack-mod-apk-free-download_GM406889139.pdf
- https://www.campguru.co.za/images/free-vpn-for-minecraft_GM479516143.pdf
- https://www.campguru.co.za/images/minecraft-free-online-games_GM479516143.pdf
- https://www.campguru.co.za/images/free-games-like-roblox_GM431946152.pdf
- https://www.campguru.co.za/images/rbx-website_GM431946152.pdf
- https://www.campguru.co.za/images/free-outfits-roblox_GM431946152.pdf
- https://www.campguru.co.za/images/coin-master-game-hacks_GM406889139.pdf
- https://www.campguru.co.za/images/coin-master-spin-hack-trick_GM406889139.pdf
- https://www.campguru.co.za/images/free-vip-server-roblox_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004a4a.bin` `fdb4b4db1929862d6e68f0a136e0f315263a94fd6adb9cbc98f1808867c9704f`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4A4A	25108 bytes
`font_01_sfnt_off000082f6.bin` `3811f2fb1880daf4953efcc9c7427d9b438bced237490b00be4a6ec3ecea79e0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x82F6	3092 bytes
`font_02_sfnt_off00008da0.bin` `6dfee1982b58ab3489cc821793519200b658269375d8b02cd788103d93863fb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DA0	17952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.