MALICIOUS
122
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The document presents a lure for game-related scripts and employs an advance-fee scam, instructing the user to interact with embedded links. The presence of multiple URLs and the ML classifier's high confidence score indicate a malicious intent to direct users to download potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.7795
Heuristics 5
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/boku-no-roblox-remastered-op-gui-script-hack
- http://www.sfakia-online.com/images/farmtown-roblox-cheats.pdf
- http://cleanteclogistics.com/images/get-free-robux-on-ipad.pdf
- http://www.marambio.com.ar/images/can-i-get-free-money-on-roblox-adopt-me-2021.pdf
- http://webstan.be/images/hack-de-roblox-jailbreak-descargar.pdf
- http://www.eaapiaria.es/images/redeem-card-roblox-free.pdf
- http://www.mjclautrec.fr/images/is-kinetic-code-going-to-be-free-roblox.pdf
- http://moralcenter.or.th/images/free-robux-pastebin-august-2021.pdf
- http://bilhetim.com.br/images/descargar-programa-para-hackear-roblox.pdf
- http://naturschutzgossau-zh.ch/images/robux-computer-hack.pdf
- https://www.coriglianocalabro.it/images/fps-roblox-free.pdf
- https://www.tsdb.com.au/images/free-roblox-promo-codes-2021-august.pdf
- http://www.lycee-langevin-wallon.com/images/free-robux-givaways.pdf
- https://septik-montag.ru/images/ss-hub-free-roblox.pdf
- http://www.maakherumusic.net/images/free-robux-hack-without-downloading-apps.pdf
- http://techmobil.pl/images/how-to-get-free-shirts-on-roblox-2021-without-bc.pdf
- http://hemmet-strand.dk/images/how-to-equip-knife-roblox-hack.pdf
- http://www.malonmalon.com.ar/images/free-bc-roblox-2021.pdf
- http://palogar.es/images/code-kingdoms-free-roblox.pdf
- http://musical-arts.de/images/free-robux-generator-google-chrome-plugin.pdf
- https://www.udivadlahotel.cz/images/pastel-hair-roblox-free.pdf
- http://eltisstudio.sk/images/how-hack-roblox-money.pdf
- https://gestionpatrimonial.net/images/hacks-para-skywars-roblox-2021.pdf
- http://jobsy.com.sg/images/roblox-hack-in-2021.pdf
- http://www.rezbb.sk/images/free-robux-no-download-or-email.pdf
- https://www.academiaanticorrupcion.org/images/roblox-wizard-life-galleons-hack.pdf
- http://bolsaycapital.com/images/cheat-aimbot-roblox-mdiafire.pdf
- http://www.lycee-langevin-wallon.com/images/how-to-hack-a-person-on-roblox-2021.pdf
- http://osteonad.com/images/free-robloxs-username.pdf
- http://zarinnameh.ir/images/roblox-hack-tool-robux-and-tix-no-survey.pdf
- https://gabrieliassociati.com/images/roblox-how-to-get-free-gear-2021.pdf
- http://swibome.nl/images/how-to-tell-if-you-have-been-hacked-on-roblox.pdf
- http://pourvosvacances.com/images/how-to-hack-in-roblox-without-cheat-engine.pdf
- http://vipservice-bg.com/images/change-your-in-game-name-on-roblox-hack.pdf
- https://sitam.co.in/images/best-pklayed-games-free-roblox.pdf
- https://itv-grabungen.de/images/ass-hurt-free-roblox.pdf
- https://www.cfdcnv.com/images/cheat-engine-63-roblox-apocalypse-rising.pdf
- https://gabrieliassociati.com/images/wwwrobux-party-com-free-robux.pdf
- https://www.cnte.org.br/images/roblox-hacks-flame.pdf
- http://dmoraitis.gr/images/vip-roblox-free.pdf
- https://shimony.net/images/roblox-how-to-get-free-skins.pdf
- http://domaizdereva24.ru/images/roblox-app-free-download-for-android.pdf
- http://subarulegacy.com/images/roblox-legend-of-the-fallen-kingdom-2-rpg-cheats.pdf
- http://optsuvenir.by/images/games-that-have-free-robux.pdf
- http://grugliascogiovani.org/images/free-roblox-card-codes-not-used-2021.pdf
- http://www.remiauclair.fr/images/getting-my-roblox-account-hacked.pdf
- http://www.fluidtech.hu/images/roblox-hack-2021-robux.pdf
- https://jdlgroup.ca/images/hack-pour-avoir-plein-de-lgendaire-roblox-bubble-gum.pdf
- https://www.udivadlahotel.cz/images/free-roblox-exploits-2021.pdf
- http://learningarabic.co.uk/images/how-to-hack-jailbreak-roblox-2021.pdf
+20 more URL(s)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off000084a7.bin2340a21c79430d7c0d71aa5428dbdffae700549d04dc1d01ab421ce1ec93981d |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x84A7 | 26808 bytes |
font_01_sfnt_off0000c10d.bine2df4c54f2f0d04ded70c1ca17237419d2602e697790957b24ed054e87f4b126 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC10D | 18720 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.