SUSPICIOUS
42
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a prominent link to 'netcdn.tw' which is presented as a download for 'minecraft-dungeons-free-download-pc-game-hack'. This, combined with the ML classifier flagging the PDF as malicious and the presence of numerous other suspicious URLs related to game hacks and free currency, strongly suggests a phishing or malware distribution attempt. The document body itself contains the primary malicious URL, reinforcing the lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9980
Heuristics 3
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://netcdn.tw/app/479516143/minecraft-dungeons-free-download-pc-game-hack PDF link annotation
- https://htdvn.com/public/upload/files/coin-master-hack-online-cheat_GM406889139.pdfIn PDF document text
- https://htdvn.com/public/upload/files/free-robux-for-roblox-yolasite-com_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/roblox-promo-code-to-get-free-robux_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/robux-match_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/free-robux-gift-card-generator_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/roblox-promo-codes-for-free-robux_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/free-robux-generator-without-verification_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/how-to-get-free-robux-on-roblox-2021_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/how-to-hack-in-arsenal_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/video-roblox-free-robux-with-promo-codes-2021-august_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/how-to-make-developer-products-free-on-roblox_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/coin-master-hack-tips_GM406889139.pdfIn PDF document text
- https://htdvn.com/public/upload/files/how-to-change-change-your-name-on-roblox-for-free_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/roblox-promo-codes-list-free_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/free-robux-generator_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/minecraft-mobile-free_GM479516143.pdfIn PDF document text
- https://htdvn.com/public/upload/files/can-you-get-robux-for-free_GM431946152.pdfIn PDF document text
- https://htdvn.com/public/upload/files/coin-master-100-spin-hack_GM406889139.pdfIn PDF document text
- https://htdvn.com/public/upload/files/free-coin-app_GM406889139.pdfIn PDF document text
- https://htdvn.com/public/upload/files/youtube-how-to-get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003167.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3167 | 22748 bytes |
SHA-256: f3f52911a16cfabf319581bc8f0bf375af0d375e8d792d3487f9e7c204f5a45a |
|||
font_01_sfnt_off00006400.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6400 | 18872 bytes |
SHA-256: 05183faf73e067548e32258fc58809d25a8fef905510eff8eab59b37bb03aee7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.