SUSPICIOUS
42
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains multiple embedded URLs and a heuristic firing for PDF_URI, indicating an attempt to redirect the user to external content. The document body, though partially corrupted, suggests a lure related to online gaming ('Roblox hacker', 'free robux'). The ML classifier also flagged the PDF as malicious. The presence of multiple PDF-related URLs suggests a phishing or scam campaign.
Machine Learning
- Nyx PDF Classifier malicious score 0.9580
Heuristics 3
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/is-friending-a-roblox-hacker-bad PDF link annotation
- http://optiquedelavaunage.com/images/get-free-roblox-right-this-second.pdfIn PDF document text
- http://egorplitka.ru/images/free-robux-no-task.pdfIn PDF document text
- http://shinarb.by/images/roblox-freak-bloxers-hacks.pdfIn PDF document text
- http://alroglobal.com/images/free-roblox-really-small-head.pdfIn PDF document text
- http://moralcenter.or.th/images/free-roblox-accounts-2021-with-robux-august.pdfIn PDF document text
- http://www.lionel-seppoloni.fr/images/free-captain-costumes-roblox.pdfIn PDF document text
- http://elzet-opakowania.pl/images/free-gamepasses-for-roblox.pdfIn PDF document text
- https://osk-sibir.ru/images/how-to-get-free-robux-and-tix-on-roblox-2021.pdfIn PDF document text
- http://global-tech-security.be/images/hacks-no-download-for-counter-blox-roblox.pdfIn PDF document text
- http://www.boic.nl/images/how-to-hack-money-in-roblox-rocitizens.pdfIn PDF document text
- https://liceucastrodelapenya.com/images/roblox-cheat-engine-and-ccv5-bypass-2021.pdfIn PDF document text
- https://eleganceautospa.ca/images/roblox-magnet-sim-hack.pdfIn PDF document text
- http://possumholler.us/images/roblox-its-free-2021.pdfIn PDF document text
- http://poltekkeskhjogja.ac.id/images/google-how-do-you-get-free-robux.pdfIn PDF document text
- http://drentklubben.se/images/robux-free-real-2021.pdfIn PDF document text
- http://adues.org/images/how-to-get-free-admin-in-any-roblox-game.pdfIn PDF document text
- http://plantas.net/images/roblox-admin-commands-dll-hack.pdfIn PDF document text
- http://villazeus.eu/images/www-free-robux-come.pdfIn PDF document text
- http://scuttworksdesigns.us/images/roblox-cheat-free-gamepass.pdfIn PDF document text
- http://solidcommunication.ch/images/money-hack-for-roblox-vehicle-simulator.pdfIn PDF document text
- http://montchanintt.fr/images/pastebin-roblox-account-hack.pdfIn PDF document text
- http://cmme.it/images/robux-free-logiciel.pdfIn PDF document text
- http://atelierweb.it/images/talk-other-player-roblox-gui-hack.pdfIn PDF document text
- http://origamiperu.com/images/roblox-hack-any-game.pdfIn PDF document text
- http://energotestcontrol.ru/images/roblox-basewar-cheats.pdfIn PDF document text
- http://forsazh-51.ru/images/hack-forums-for-roblox.pdfIn PDF document text
- https://www.mvp.co.nz/images/roblox-prison-life-btools-hack.pdfIn PDF document text
- http://interokna-kuban.ru/images/free-level-7-exploit-for-roblox.pdfIn PDF document text
- http://armatrutz.de/images/free-robux-obux.pdfIn PDF document text
- http://www.bestyears.co.uk/images/free-item-hack-roblox.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005a4b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5A4B | 23568 bytes |
SHA-256: 40c06caed4c9a1430ca6f0ffd0db886b4aa1134133652b1b3a9ce102c40d324f |
|||
font_01_sfnt_off00008f7c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8F7C | 18656 bytes |
SHA-256: ab40ac8f33d8cb7fde19d8a34b5f2d1493820bdffe7b9ab56f32d192e136f619 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.