SUSPICIOUS
42
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a lure for 'Free Robux Gift Card Codes 2021' and includes an external URI pointing to a suspicious domain. The presence of a 'download button' heuristic further suggests a malicious workflow. The ML classifier also flagged this PDF as malicious, increasing confidence in its suspicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.6193
Heuristics 3
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/free-robux-gift-card-codes-2021 PDF link annotation
- https://pagadder.com/images/roblox-gift-card-free-no-human-very-or-survey-youtube.pdfIn PDF document text
- https://grovehilloutfitters.com/images/games-that-you-can-get-free-robux.pdfIn PDF document text
- http://vagency.us/images/how-to-hack-roblox-accounts-2021.pdfIn PDF document text
- https://www.fenews.co.uk/images/roblox-vehicle-simulator-money-hack-2021.pdfIn PDF document text
- http://smart-pro.co.uk/images/free-roblox-gift-card-codes-august-2021.pdfIn PDF document text
- https://consorziocsa-asicaivano.it/images/roblox-free-objet.pdfIn PDF document text
- http://www.marambio.com.ar/images/how-to-get-free-robux-no-human-verification-2021.pdfIn PDF document text
- http://mypizzaoven.com/images/how-to-get-free-robux-computer-only.pdfIn PDF document text
- https://servotecnica.com/images/how-to-get-free-robux-on-fortnite.pdfIn PDF document text
- https://jdlgroup.ca/images/free-robux-no-surveys-or-verification.pdfIn PDF document text
- http://italymania.ru/images/apps-for-friends-2021-free-robux-site-playgooglecom.pdfIn PDF document text
- http://www.st-regulus-lgc.co.uk/images/game-guardian-roblox-speed-hack.pdfIn PDF document text
- http://consultinggirona.es/images/roblox-ore-tycoon-2-bag-obby-cheats.pdfIn PDF document text
- http://shootawayproduction.com/images/boku-no-roblox-hack-legendary-quirks.pdfIn PDF document text
- https://www.elevage-chiot.fr/images/free-robux-aout-2021.pdfIn PDF document text
- http://linde-erbach.de/images/free-costume-in-roblox.pdfIn PDF document text
- http://www.kalaaliaraq.dk/images/robux-hack-2021.pdfIn PDF document text
- http://hk-kan.org/images/hack-ninja-assassin-roblox.pdfIn PDF document text
- https://rieber-transporte.de/images/how-to-cheat-in-roblox-mazes.pdfIn PDF document text
- http://www.hawler.in/images/roblox-free-robux-and-builders-club-hack.pdfIn PDF document text
- https://verdensbarn.no/images/roblox-new-hack.pdfIn PDF document text
- http://act.gr/images/how-to-get-infinite-robux-on-roblox-hack.pdfIn PDF document text
- https://www.utalii.ac.ke/images/free-robux-card-codes-2021-december.pdfIn PDF document text
- http://www.cosver.nl/images/free-boys-shirts-roblox-codes.pdfIn PDF document text
- http://keepcasscountybeautiful.com/images/how-do-u-hack-someones-account-on-roblox.pdfIn PDF document text
- http://www.copoint.co.uk/images/proxo-cheat-roblox-download.pdfIn PDF document text
- http://poltekkeskhjogja.ac.id/images/game-hacked-decal-roblox.pdfIn PDF document text
- http://asiashop-france.fr/images/how-to-hack-another-player-on-roblox-not-working.pdfIn PDF document text
- http://instrutech.co.th/images/free-robux-website-bloxburg-sign.pdfIn PDF document text
- http://jasperfirstumc.com/images/how-to-make-your-own-dominus-in-roblox-for-free.pdfIn PDF document text
- http://fa-deco.com/images/roblox-robux-hack-script-for-free-robux.pdfIn PDF document text
- https://www.sitiwebjoomla.it/images/how-to-hack-mad-city-roblox.pdfIn PDF document text
- http://bilhetim.com.br/images/roblox-las-vegas-money-hack.pdfIn PDF document text
- http://bunadsmaria.com/images/free-girl-account-roblox.pdfIn PDF document text
- https://corbo.ru/images/can-free-models-steal-your-password-roblox.pdfIn PDF document text
- http://www.bripi.pl/images/roblox-free-lua-executor.pdfIn PDF document text
- https://digitalsenseafrica.com.ng/images/roblox-plates-of-fate-hack-floating.pdfIn PDF document text
- http://briankellyforcongress.com/images/how-to-fine-addresses-in-cheat-engine-for-roblox.pdfIn PDF document text
- http://centuriatus.com/images/veichle-simulator-roblox-hack.pdfIn PDF document text
- https://www.yewtreealpacas.co.uk/images/roblox-rainbow-shaggy-free.pdfIn PDF document text
- http://nosocomium.rv.ua/images/nbc-roblox-free-accounts.pdfIn PDF document text
- http://abletrustcare.com/images/roblox-hack-999999-robux-2021-android.pdfIn PDF document text
- http://shahriyarclimb.com/images/robux-hack-2021-free.pdfIn PDF document text
- http://akademiatenisa.org/images/focus-points-hack-roblox-dance-your-blox-off.pdfIn PDF document text
- http://wcasrock.org/images/roblox-gift-card-includes-free-virtual-item.pdfIn PDF document text
- http://palogar.es/images/free-roblox-outfits-and-more.pdfIn PDF document text
- http://hydroconseil.net/images/getting-free-robux-on-a-website.pdfIn PDF document text
- https://www.udivadlahotel.cz/images/free-robux-2021-code.pdfIn PDF document text
- http://cosver.eu/images/bypass-cheat-engine-roblox.pdfIn PDF document text
+19 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off000081d1.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x81D1 | 26148 bytes |
SHA-256: c4b1279d5e44a297584e0731e9c9648906989cd20414deb67548a7709893211b |
|||
font_01_sfnt_off0000beff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBEFF | 3380 bytes |
SHA-256: a91a5cf6acfcf0d5e2ebc12c2b1474034bad5302098e078a7b46346115763e44 |
|||
font_02_sfnt_off0000ca96.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCA96 | 18624 bytes |
SHA-256: 349a498b22f9522ee17df1dd2ed0ea49ed120a1067a39fca234f33b04297fdf8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.