Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ce121f03975a85e…

MALICIOUS

PDF

44.1 KB Created: 2021-05-16 22:35:51 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 8f03606b477e1c0894161f20da4cec78 SHA-1: ee1dcaec7bd91f187c66de5610e819c93d444690 SHA-256: 7ce121f03975a85e2f4d3710c76b504d130614c1b607ac83c1874a5b0c45dc31
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains numerous embedded links, many of which are SEO-optimized slugs pointing to game-related hacks and free currency. The 'ClickFix' heuristic indicates the document likely instructs users to execute commands or open links directly, bypassing typical macro-based execution. The ML classifier strongly flags this PDF as malicious, supporting the conclusion that it is designed to trick users into visiting malicious sites or downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-java-edition-free-trial-game-hack
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/coin-master-32-mod-hack-apk-download_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/static-moonactive-net-free-spins-coin-master_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/pop-slots-free-vegas-casino-slots-machine-game-coin-master_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/coin-master-links-free-spins_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/coin-master-hack-spins_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-2021_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/cute-free-hair-on-roblox_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/wwwcoin-master-free-spincom_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/free-card-collection-in-coin-master_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-on-mobile_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/roblox-admin-hack_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/roblox-free-play-no-download_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/free-100-robux_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/minecraft-hack-client-download_GM479516143.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/coin-master-free-blogspot_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/free-robux-come_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/who-to-get-free-robux_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/free-links-for-coin-master_GM406889139.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/how-to-hack-a-roblox-account-easy_GM431946152.pdf
    • https://elearning.mtsn11madiun.sch.id/__statics/gudangsoal/files/how-to-hack-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004ec3.bin
472b0a2c7e233638491a466db3f4f1850fe3509c86061a8991d8f044cb39172e		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4EC3 26120 bytes
font_01_sfnt_off00008a31.bin
1be29b22a500e2a60a7236cc7f3818504a778037c129f908a3826a58d12b939a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A31 18240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.