MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a high-severity heuristic indicating it links to a 'free generator / game hack' redirector, specifically pointing to a URL related to 'free Robux'. The document body also contains similar lure text and numerous related URLs, suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence.
Machine Learning
- Nyx PDF Classifier malicious score 0.9969
Heuristics 4
-
PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LUREPDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://netcdn.tw/app/431946152/power-games-free-robux-game-hack PDF link annotation
- http://italymania.ru/images/apps-to-get-free-robux_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/minecraft-free-download-pc_GM479516143.pdfIn PDF document text
- http://italymania.ru/images/free-minecraft-coloring-pages_GM479516143.pdfIn PDF document text
- http://italymania.ru/images/free-items-on-roblox-2021_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/free-minecraft-for-kids_GM479516143.pdfIn PDF document text
- http://italymania.ru/images/good-hack-scripts-for-roblox_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/coin-master-2021_GM406889139.pdfIn PDF document text
- http://italymania.ru/images/300-free-spins-coin-master_GM406889139.pdfIn PDF document text
- http://italymania.ru/images/how-to-make-free-robux_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/free-robux-hack-us_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/free-tiktok-followers-no-survey_GM835599320.pdfIn PDF document text
- http://italymania.ru/images/free-robux-easy_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/how-to-get-free-tiktok-fans-without-human-verification_GM835599320.pdfIn PDF document text
- http://italymania.ru/images/roblox-speed-hack_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/coin-master-daily-free-spins-haktuts_GM406889139.pdfIn PDF document text
- http://italymania.ru/images/how-to-get-free-robux-no-verification_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/free-robux-2021_GM431946152.pdfIn PDF document text
- http://italymania.ru/images/coin-master-free-daily-spins-link_GM406889139.pdfIn PDF document text
- http://italymania.ru/images/free-roblox-account-generator_GM431946152.pdfIn PDF document text
- http://192.168.0.99/%20%3Cp%3E%3Cp%3Eroblox%20restaurant%20tycoon%20diamond%20hack%3Cp%3E%3Cp%3Ehow%20to%20hack%20roblox%20with%20tampermonkey%3Cp%3E%3Cp%3ECheck%20out%201M%20free%20Robux!.%201M%20free%20Robux!%20By%20Tennisballgolfball4.%3Cp%3E%3Cp%3Efree%20roblox%20accounts%20with%20robux%202020%3Cp%3E%3Cp%3ELinphone%20is%20an%20open%20source%20SIP%20client%20for%20HD%20voice/video%20calls,%201-to-1%20and%20group%20instant%20messaging,%20conference%20calls%20etc.%20Available%20for%20iOS,%20Android,%20Windows,%20macOS%20and%20GNU/Linux.%3Cp%3E%3Cp%3Eroblox%20free%20executor%202019%3Cp%3E%3Cp%3EGet%20To%20Know%20More%20About%20ROBLOX%20FREE%20ROBUX%20GENERATOR%20Codes%20Hack%20On%20WiseIntro%20Portfolio%20-%20Providing%20a%20Beautiful%20Website%20That%20Works%20For%20You,%20Helping%20You%20Raise%20Your%20Profile%20&%20Attract%20New%20Clients%3Cp%3E%3Cp%3Ehow%20to%20get%20free%20admin%20in%20roblox%20on%20all%20games%3Cp%3E%3Cp%3Ebuy%20roblox%20for%20free%3Cp%3E%3Cp%3Ehow%20to%20get%20free%20robux%20and%20tix%20on%20roblox%20mobile%3Cp%3E%3Cp%3EWhat%20do%20you%20use%20to%20edit%20your%20videos.%20Check%20out%20eating%20simulator%202.%20Doppler%20Hat%20Games%20Dopplerhat%20Twitter.%200%20replies%200%20retweets%200%20likes.%20Message%20us%20through%20twitter%20roblox%20or%20the%20community.%20Roblox%20weapon%20simulator.%20Collect%20coins%20to.%3Cp%3E%3Cp%3EStill%20Wondering%20How%20to%20get%20Free%20Robux%20No%20Survey%20No%20Scam%20No%20Human%20Verification%20for%20Kids.%20You%20can%20do%20virtually%20anything%20with%20Robux%20in%20Roblux%20games.%20If%20youIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004d8c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D8C | 25488 bytes |
SHA-256: 2d4be41924308befb0621a07cac9e5580950600acf2b9d590834ba49185d665a |
|||
font_01_sfnt_off000086f1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x86F1 | 18244 bytes |
SHA-256: 2299db7974cfc9abab0d6ebd176c09a57c7649953618fabd1d11cce9bfa4af27 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.