MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous links to external websites, many of which are algorithmically generated and point to game-related hacks and cheats. The ML classifier also flagged this PDF as malicious. The presence of a 'download button' heuristic further suggests a malicious workflow aimed at tricking users into downloading potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.8948
Heuristics 4
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://netcdn.xyz/app/431946152/how-to-change-roblox-username-for-free-game-hack
- https://pemadamapi.net/images/coin-master-free-spins-hack-iphone_GM406889139.pdf
- https://pemadamapi.net/images/free-spin-coin-master-2021_GM406889139.pdf
- https://pemadamapi.net/images/wwwhaktutsin-2021-08-coinmasterfreespinandcoinlinkhtml-m-1_GM406889139.pdf
- https://pemadamapi.net/images/minecraft-hacks-wurst_GM479516143.pdf
- https://pemadamapi.net/images/abd-roblox_GM431946152.pdf
- https://pemadamapi.net/images/how-to-get-free-roebucks-on-roblox_GM431946152.pdf
- https://pemadamapi.net/images/coin-master-hack-no-verification-no-signup_GM406889139.pdf
- https://pemadamapi.net/images/www-free-robux-com_GM431946152.pdf
- https://pemadamapi.net/images/coin-master-hack-spin-generator-tool_GM406889139.pdf
- https://pemadamapi.net/images/roblox-booga-booga-hack_GM431946152.pdf
- https://pemadamapi.net/images/coin-master-free-spins-and-coins-link-today_GM406889139.pdf
- https://pemadamapi.net/images/minecraft-for-free-games_GM479516143.pdf
- https://pemadamapi.net/images/coin-master-spins-and-coins_GM406889139.pdf
- https://pemadamapi.net/images/free-draw-2-roblox_GM431946152.pdf
- https://pemadamapi.net/images/get-free-robux-no-human-verification_GM431946152.pdf
- https://pemadamapi.net/images/how-to-hack-roblox-accounts-for-robux_GM431946152.pdf
- https://pemadamapi.net/images/get-me-robux_GM431946152.pdf
- https://pemadamapi.net/images/minecraft-pe-hacks-ios_GM479516143.pdf
- https://pemadamapi.net/images/free-robux-now_GM431946152.pdf
- https://pemadamapi.net/images/how-to-get-free-robux-promo-codes_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00004a68.bine2917d257dfb9e494eab1e8aef197d7295a7bbd30dfd0b6c1f015640d950d9bd |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x4A68 | 25812 bytes |
font_01_sfnt_off000086a1.bin40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x86A1 | 3884 bytes |
font_02_sfnt_off00009349.bin61006e5f3dddd6435ab0a2755610421e2f864d25a13f3f522a83b1d149be9d74 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9349 | 19240 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.