MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF document contains a large number of links to external PDF files, many of which appear to be related to game hacks and cheats. The primary URL http://netcdn.tw/app/406889139/free-game-pack-with-google-play-coin-master-game-hack suggests a lure for downloading game-related content. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of exploitation or malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://netcdn.tw/app/406889139/free-game-pack-with-google-play-coin-master-game-hack PDF link annotation
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/minecraft-creative-mode-free_GM479516143.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/hack-para-todos-los-juegos-de-roblox-2021_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/comapp-trekfree-coin-spindaily-link-master_GM406889139.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/free-minecraft-codes_GM479516143.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/hack-runner-roblox_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/how-to-get-free-robux-on-the-front-page_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/free-robux-sites-that-work_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/free-bird-in-roblox_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/coin-master-free-spins-link-deutsch-ios_GM406889139.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/coin-master-hack-spin-generator_GM406889139.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/how-to-hack-roblox-games_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/coin-master-free-spins-promo-code_GM406889139.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/website-roblox-free-robux_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/bleu-roblox-exploit-download-free_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/was-minecraft-ever-free_GM479516143.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/roblox-jailbreak-noob-vs-pro-vs-hacker_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/roblox-cash-hack-script-pastebin-2021_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/how-to-hack-coin-master-using-es-filer_GM406889139.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/roblox-jailbreak-free-money-codes_GM431946152.pdfIn PDF document text
- http://www.lorengindonesia.com/new/public/ckfinder/userfiles/files/how-to-use-process-hacker-for-roblox_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off000035f7.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x35F7 | 23164 bytes |
SHA-256: 3c95fb39088238df0325d1367ca8f6673e9eba758b2ff5f0a9ca33da47e50de5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.