MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document contains embedded links and a visual download button, strongly suggesting a lure to download malicious content. The primary link directs to a known malicious redirector infrastructure, indicating a high likelihood of malware distribution. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9980
Heuristics 3
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://netcdn.co/app/431946152/roblox-hack-apk-2.401-game-hack In PDF document text
- https://www.owlweb.co.uk/uploads/files/files/roblox-premium-free_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/how-to-make-robux-on-roblox_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/how-to-hack-peoples-roblox-accounts_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/free-boy-roblox-blue-hair-com_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/coin-master-links-to-free-spins_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/coin-master-free-spins-app_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/minecraft-bedrock-hacks_GM479516143.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/coin-master-gold-cards-hack_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/coin-master-mod-version-free-download-ios_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/how-do-you-get-the-hacker-cat-roblox_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/coin-master-hack-app-for-iphone_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/free-robux-without-human-verification-real_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/win-free-robux_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/apps-that-give-you-free-robux_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/how-many-levels-are-in-coin-master_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/roblox-hacks-2021_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/hack-free-spin-coin-master_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/roblox-rape-hack_GM431946152.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/master-free-spin-and-coin-links-html-m-1_GM406889139.pdfIn PDF document text
- https://www.owlweb.co.uk/uploads/files/files/flip-master-free-coins_GM406889139.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002f06.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2F06 | 21912 bytes |
SHA-256: 0e0296e09718ea89c06b54ef357fd4486a731b90303afdb71c87b54bd4026d7a |
|||
font_01_sfnt_off00005f62.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5F62 | 19364 bytes |
SHA-256: a3d79b15c99fff5bbeeebaef031e5151dae6205b63e896bf5750996a6d924d60 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.