PDF static analysis report

Static analysis result for SHA-256 c5af1803e6bb13c6…

SUSPICIOUS

PDF

40.3 KB Created: 2021-05-10 12:04:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-05
MD5: fe9d702547c8d096eb29db80d32c91cd SHA-1: 4eaabf2d99c542b168238f58eaf8c8b07d94083f SHA-256: c5af1803e6bb13c6061ab0747c007c40d4e3f539df9f6e0a3ebc14127bcefc97
52 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File Execution: User Execution

The PDF document contains a link to a suspicious URL that purports to offer a Minecraft APK download. It also employs social engineering tactics, instructing the user to press Win+R or paste a command, which is a common method to bypass macro restrictions and execute arbitrary commands. The presence of a fake download button further supports the social engineering lure.

Machine Learning

  • Nyx PDF Classifier clean score 0.0334

Heuristics 4

  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-pe-0.15-0-apk-free-download-game-hack PDF link annotation
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00003861.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3861 29432 bytes
SHA-256: 55e24c6d8f38517d78dc6a6a03a76984b23c9e65899998708f77ecd844996c78
font_01_sfnt_off0000799b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x799B 19268 bytes
SHA-256: 9273c8c2b8a269721a9438858e1c0aeb95c142b4551f9d4ca11e724d76d79d6e

Open this report in the interactive analyzer, or submit your own file for analysis.