MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The document contains numerous links and references to game hacks and free Robux, indicating a social engineering lure. The presence of external URIs and a high ML classifier score suggest malicious intent. The document body and heuristics point towards a phishing attempt to trick users into downloading a malicious payload disguised as a game hack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9824
Heuristics 4
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://netcdn.co/app/431946152/free-robux-weebly-com-game-hack
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/heurne-free-robux_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/editthiscookie-roblox-hack_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/get-a-profesional-roblox-game-cover-for-free_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/cheat-engine-64-roblox-2021_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/hello-neighbor-free-play-roblox_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/noclip-roblox-hack_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/piano-hack-in-roblox_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-code-for-roblox-unicorn_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/hack-roblox-robux-2021_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/who-did-i-get-free-robux_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-minecraft-texture-packs_GM479516143.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/how-to-get-free-robux-without-downloading-apps_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/is-roblox-downloadable-on-ps4-for-free_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/roblox-dubliezieren-hack_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/roblox-parkour-hack-8-2021_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/free-roblox-source-dll_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/fnaf-roblox-free-items_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/infinite-robux-hack-2021_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/howt-to-hack-roblox-with-cmd_GM431946152.pdf
- https://zbych-pol.pl/wp-content/uploads/fsqm-files/crate-clicker-roblox-hack_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002ad0.bin82b09180750d1764baae1dbac1ed87504a75e83697bdf68565c0847fa6ae53c8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2AD0 | 21440 bytes |
font_01_sfnt_off000059df.bin856564b88e212c78749c1bc3bf7bd0aa1bc55b10f0062675eb0a131edf87c47d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x59DF | 19428 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.