Malicious PDF — malware analysis report

Static analysis result for SHA-256 59e157956faa1496…

MALICIOUS

PDF

46.5 KB Created: 2021-06-03 08:43:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4fb01929ff0a86416c39070372b65e1e SHA-1: deb77f38589e1ef2de2cf6a1800109fabf240d14 SHA-256: 59e157956faa14964862e240fd4b193b7ab41576738a13b302e470dbd82b9df1
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.003 Windows Command Shell

This PDF document employs social engineering tactics, presenting lures related to game hacks and free items to trick users into downloading further malicious content. The 'ClickFix' heuristic indicates the document likely instructs the user to execute a command, such as Win+R, to bypass security measures and download a second-stage payload from the embedded URL. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9748

Heuristics 4

  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/479516143/how-to-get-a-cape-in-minecraft-for-free-game-hack PDF link annotation
    • http://www.perpus.stfm.ac.id/repository/how-to-hack-roblox-2021_GM431946152.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/how-to-get-free-robux-on-phone-2021_GM431946152.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/coin-master-400-spin-link-hack_GM406889139.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/minecraft-pe-free-apk_GM479516143.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/how-to-play-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/how-to-get-free-robux-with-no-verification_GM431946152.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/free-spins-for-coin-master-that-work_GM406889139.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/coin-master-hack-coins_GM406889139.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/minecraft-anarchy-server-no-hacks_GM479516143.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/minecraft-on-computer-free_GM479516143.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/free-minecraft-java-server_GM479516143.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/easy-robux-hack_GM431946152.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/how-to-hack-in-roblox-prison-life_GM431946152.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/coin-master-hack-apk-35-33_GM406889139.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/how-to-get-free-items-on-roblox_GM431946152.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/minecraft-mods-download-free_GM479516143.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/earn-free-robux-today_GM431946152.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/free-robux-that-actually-works-2021_GM431946152.pdfIn PDF document text
    • http://perpus.stfm.ac.id/repository/coin-master-coins-free_GM406889139.pdfIn PDF document text
    • http://www.perpus.stfm.ac.id/repository/pokemon-go-free-codes-october-2021_GM1094591345.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000051af.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x51AF 24716 bytes
SHA-256: 6f9a805ed76a1f515dd1670b2a8318a51c3c01e7720f74f7fd0a8402f0e3a673
font_01_sfnt_off00008943.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8943 3056 bytes
SHA-256: 3bf38ccea0f059764ae863929582790583b2dd886e86d92a85837ff3e16544f0
font_02_sfnt_off000093b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x93B7 18052 bytes
SHA-256: 651613c0b0933ea46dfe34ab8437030315119b6d54c219aba7cf9326f75e4fa1

Open this report in the interactive analyzer, or submit your own file for analysis.