Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec03f9c6c7a7d010…

MALICIOUS

PDF

44.4 KB Created: 2021-05-15 13:27:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 3203eb6d43b7c3d8938d1e4690546b7f SHA-1: 235b7edbbbfac87211347f5ff917080cb0f24df9 SHA-256: ec03f9c6c7a7d01069a198cb33a3d53870325fb3fc466646e8c38728f1356c37
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document is identified as malicious by an ML classifier and exhibits social engineering tactics, specifically a 'ClickFix' lure. It contains embedded URLs pointing to what appear to be game hacks or cheats, aiming to trick users into downloading malicious applications. The document also instructs users to execute commands, likely to bypass security controls and facilitate the download or execution of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-apk-1.14-game-hack
    • http://ff-obertraun.at/images/oprewards-com-roblox_GM431946152.pdf
    • http://ff-obertraun.at/images/roblox-free-robux-hack_GM431946152.pdf
    • http://ff-obertraun.at/images/how-to-get-free-robux-2021_GM431946152.pdf
    • http://ff-obertraun.at/images/coin-master-hack-android-root_GM406889139.pdf
    • http://ff-obertraun.at/images/how-to-get-free-robux-without-downloading-any-apps_GM431946152.pdf
    • http://ff-obertraun.at/images/coin-master-cheats-without-verification_GM406889139.pdf
    • http://ff-obertraun.at/images/coin-master-hack-apk-facebook-login_GM406889139.pdf
    • http://ff-obertraun.at/images/minecraft-iphone-free_GM479516143.pdf
    • http://ff-obertraun.at/images/minecraft-rtx-download-free_GM479516143.pdf
    • http://ff-obertraun.at/images/roblox-comcom_GM431946152.pdf
    • http://ff-obertraun.at/images/free-robux-safe_GM431946152.pdf
    • http://ff-obertraun.at/images/latest-free-spin-coin-master-daily_GM406889139.pdf
    • http://ff-obertraun.at/images/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
    • http://ff-obertraun.at/images/free-400-spins-coin-master_GM406889139.pdf
    • http://ff-obertraun.at/images/daily-coin-master-free-spin-link_GM406889139.pdf
    • http://ff-obertraun.at/images/how-do-you-hack-roblox_GM431946152.pdf
    • http://ff-obertraun.at/images/free-coins-for-flip-master-online_GM406889139.pdf
    • http://ff-obertraun.at/images/coin-master-gold-cards-free-2021_GM406889139.pdf
    • http://ff-obertraun.at/images/free-robux-generator-com-roblox-hack_GM431946152.pdf
    • http://ff-obertraun.at/images/coin-master-hackcom-xyz_GM406889139.pdf
    • https://www.yout
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004bc5.bin
28236d77a3b34f61eb2a286806c72518674cbd83b47df872f22b0c8ebfc13efe		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4BC5 28516 bytes
font_01_sfnt_off00008bea.bin
7bdfed4e6bb9116c1e8b762c9aa300c7ad7e0d5b74d60207ce67a22ebb633bf5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BEA 18148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.