MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The document presents a fake CAPTCHA or human verification prompt to trick the user into interacting with it, likely to initiate a download. The embedded URL points to a resource that could be a second-stage payload. No scripts were extracted from this sample, limiting the ability to determine specific execution methods.
Machine Learning
- Nyx PDF Classifier malicious score 0.9464
Heuristics 4
-
Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHADocument displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://netcdn.xyz/app/431946152/roblox-crashes-when-cheat-engine-open-game-hack
- https://tjiko.de/wp-content/uploads/fsqm-files/minecraft-apk-free-download_GM479516143.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/games-that-give-you-free-robux_GM431946152.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/minecraft-build-hacks_GM479516143.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/daily-free-spins-for-coin-master_GM406889139.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/is-minecraft-free-on-ps4_GM479516143.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/free-robux-gift-card-codes_GM431946152.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/coin-master-free-coins-and-spins-app_GM406889139.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/free-tiktok-likes-2021_GM835599320.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/best-minecraft-hacks_GM479516143.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/robux-free-com_GM431946152.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/coin-master-free-spins-link-blogspot-2021_GM406889139.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/free-disney-plus-accounts-tiktok_GM835599320.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/how-to-get-free-robux-for-real_GM431946152.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/roblox-is-getting-hacked_GM431946152.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/free-coin-master-coins_GM406889139.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/free-tiktok-like_GM835599320.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/minecraft-free-download-mac_GM479516143.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/coin-master-free-spin-and-coins-links-2021_GM406889139.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/free-roblox-free-hack_GM431946152.pdf
- https://tjiko.de/wp-content/uploads/fsqm-files/free-robux-link_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off00004e1f.bin7473f556f6240c4e46b18f5ee7280b7ee5acff66d312296dd5ce009a2adddb0c |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x4E1F | 27516 bytes |
font_01_sfnt_off00008bf8.bine6d68e720ea5acf9dccbf7ffde18db6f65c62a99ab7725aa43e30329033a7787 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8BF8 | 8132 bytes |
font_02_sfnt_off0000a6e5.bina1f869d98d6d4e2b1b64e4ff0304eb6e7796c44743fd2fb5d9fddf04cefc2938 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA6E5 | 19064 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.