MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains multiple embedded URLs and a primary external URI pointing to resources offering "Coin Master free game hack" or similar cheats. The ML classifier strongly flagged this PDF as malicious, and the presence of a visual download button lure and callback phishing lure suggests a deceptive workflow. The document's intent is to trick the user into downloading a secondary payload by masquerading as a cheat or hack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9971
Heuristics 4
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://netcdn.xyz/app/406889139/coinmasterfree-game-hack
- https://www.linzgau-kjh.de/images/oginject-co_GM406889139.pdf
- https://www.linzgau-kjh.de/images/coin-master-card-collection-link_GM406889139.pdf
- https://www.linzgau-kjh.de/images/how-to-hack-roblox-accounts-on-phone-2021_GM431946152.pdf
- https://www.linzgau-kjh.de/images/free-robux-websites-that-actually-work_GM431946152.pdf
- https://www.linzgau-kjh.de/images/coin-master-hack-without-verification-ios_GM406889139.pdf
- https://www.linzgau-kjh.de/images/coin-master-free-spin-link-app_GM406889139.pdf
- https://www.linzgau-kjh.de/images/coin-master-hack-https-coinms-net_GM406889139.pdf
- https://www.linzgau-kjh.de/images/coin-master-link_GM406889139.pdf
- https://www.linzgau-kjh.de/images/free-robux-generator-2021-no-survey_GM431946152.pdf
- https://www.linzgau-kjh.de/images/roblox-hacked-accounts-list_GM431946152.pdf
- https://www.linzgau-kjh.de/images/free-spin-app-coin-master_GM406889139.pdf
- https://www.linzgau-kjh.de/images/roblox-hacked-com-2021_GM431946152.pdf
- https://www.linzgau-kjh.de/images/free-coin-master-coins-and-spins_GM406889139.pdf
- https://www.linzgau-kjh.de/images/free-coins-for-coin-master-blogger_GM406889139.pdf
- https://www.linzgau-kjh.de/images/coin-master-hack-no-verification_GM406889139.pdf
- https://www.linzgau-kjh.de/images/free-coins-coin-master-blog_GM406889139.pdf
- https://www.linzgau-kjh.de/images/roblox-com-free-robux_GM431946152.pdf
- https://www.linzgau-kjh.de/images/roblox-promo-codes-free-robux_GM431946152.pdf
- https://www.linzgau-kjh.de/images/free-robux-rewards_GM431946152.pdf
- https://www.linzgau-kjh.de/images/wurst-112-2_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off0000482e.bin168d3fef61fd38d56cb936ab4a684c25f21308fb4f1fdcb029566fb79408999d |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x482E | 26672 bytes |
font_01_sfnt_off000085be.bined5fdd5441acd06a3bb02758ac945137dbfa7be696a0962169bf0eb95ec74bb8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x85BE | 17808 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.