SUSPICIOUS
42
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document was flagged as suspicious by an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9428
Heuristics 3
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/account-passwort-roblox-hack PDF link annotation
- https://accord.kiev.ua/images/bear-face-mask-roblox-free.pdf%0AIn PDF document text
- https://socialvalue.gr/images/roblox-ninja-legends-hack-script-download.pdf%0AIn PDF document text
- http://www.pcclawyers.com.au/images/free-sprite-shirt-roblox.pdf%0AIn PDF document text
- http://www.nielsen2u.dk/images/roblox-speed-hack-codes.pdf%0AIn PDF document text
- https://kimolos-link.gr/images/free-solobird-guitar-roblox.pdf%0AIn PDF document text
- http://www.nielsen2u.dk/images/easy-robux-hack.pdf%0AIn PDF document text
- https://www.fhccu.com/images/roblox-jailbreak-hack-2021-noclip.pdf%0AIn PDF document text
- http://echosvoix.ch/images/robux-win-redeem-code-hack.pdf%0AIn PDF document text
- http://www.maakherumusic.net/images/free-robux-download-pc.pdf%0AIn PDF document text
- https://www.udivadlahotel.cz/images/free-cute-outfits-on-roblox.pdf%0AIn PDF document text
- http://pa-tanjungselor.go.id/images/cheat-to-make-my-damage-higher-on-da-hood-roblox.pdf%0AIn PDF document text
- http://www.evaplast.by/images/ninja-animation-pack-roblox-free.pdf%0AIn PDF document text
- http://uctovnictvosnv.sk/images/how-to-hack-roblox-accounts-2021-unpatched.pdf%0AIn PDF document text
- https://www.najeebqasmi.com/images/i-killed-a-man-meme-hacke-d-a-roblox-server.pdf%0AIn PDF document text
- http://uctovnictvosnv.sk/images/hacking-roblox-pastebin.pdf%0AIn PDF document text
- http://www.mikramarine.gr/images/free-dominus-roblox-avatar.pdf%0AIn PDF document text
- https://www.ncscolour.no/images/free-robux-admin-codes.pdf%0AIn PDF document text
- http://www.lovecraftiana.com.ar/images/roblox-fashion-frenzy-free-games.pdf%0AIn PDF document text
- http://hemmet-strand.dk/images/free-robux-generator-password.pdf%0AIn PDF document text
- http://www.rezbb.sk/images/games-that-give-you-free-stuff-roblox.pdf%0AIn PDF document text
- http://www.kalaaliaraq.dk/images/roblox-highschool-cheat-codes.pdf%0AIn PDF document text
- http://www.exikom.com.ua/images/free-robux-generator-no-scams-no-verification.pdf%0AIn PDF document text
- https://www.wildpark-johannismuehle.de/images/howto-wall-hack-roblox.pdf%0AIn PDF document text
- http://aeroclub-kaernten.at/images/roblox-hack-tool.pdf%0AIn PDF document text
- http://echosvoix.ch/images/free-download-roblox-infinite-jump-real.pdf%0AIn PDF document text
- http://www.actae.gr/images/roblox-cheat-codes-for-robux-2021.pdf%0AIn PDF document text
- https://estalagemmonteverde.com.br/images/roblox-how-to-get-free-gamepass-v3rmillion.pdf%0AIn PDF document text
- https://www.iadh.bi/images/roblox-how-to-create-free-model.pdf%0AIn PDF document text
- http://www.marambio.com.ar/images/roblox-hacking-robux-no-suvey-and-download-2021.pdf%0AIn PDF document text
- http://cosver.eu/images/royale-high-roblox-hacks.pdf%0AIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off000045fb.bin)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000045fb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x45FB | 22636 bytes |
SHA-256: 4dcc973ce46958be510d4fceb05c4695cdc832c5587ba93e2bf88ade5e8b3b94 |
|||
font_01_sfnt_off00007821.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7821 | 18880 bytes |
SHA-256: b69fc38b55f17fac4ae9c48e6afc839f4c001a226e04486005b2b1cd5f7df840 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.