MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The document displays a fake CAPTCHA to trick the user into clicking a link, which is a common social engineering tactic. The embedded URL points to a resource related to game cheats, further supporting the lure. While no scripts were directly extracted, the PDF structure and heuristics suggest it's designed to lead the user to a malicious external resource.
Machine Learning
- Nyx PDF Classifier malicious score 0.9832
Heuristics 4
-
Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHADocument displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://netcdn.tw/app/431946152/how-to-get-free-wings-in-roblox-promo-codes-game-hack
- https://ths-academy.net/wp-content/uploads/fsqm-files/roblox-build-a-boat-cheats_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/dino-sim-roblox-apk-to-albino-terror-for-free_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/free-tiktok-fans-no-human-verification-or-downloading-apps_GM835599320.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/minecraft-classic-free_GM479516143.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/hacks-para-roblox-gratis_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/how-to-get-free-items-in-roblox-camping-game_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/how-to-speedhack-roblox-without-cheat-engine_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/minecraft-java-free_GM479516143.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/dragon-ball-x-roblox-hack_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/injector-hack-for-roblox_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/cheats-in-pet-rnch-roblox_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/free-roblox-exploits-website_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/free-tiktok-likes-no-human-verification-or-downloading-apps_GM835599320.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/free-tiktok-views-no-verification_GM835599320.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/roblox-jojo-blox-hack-script_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/minecraft-name-tag-hacks_GM479516143.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/roblox-cheats-com_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/free-group-funds-roblox_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/how-to-hack-meep-city-roblox-money-2021_GM431946152.pdf
- https://ths-academy.net/wp-content/uploads/fsqm-files/roblox-free-robux-offers_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off000056b5.bin2157db8e5a3905359c4606c195e209ddce4fda4d56dc7c73a2a668bf33e1578b |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x56B5 | 25616 bytes |
font_01_sfnt_off0000924c.binaeebd49e39de89bc9f993d1ce4b0d6d2ffe7c0895b886ef0675a93706ebd3f15 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x924C | 19408 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.