SUSPICIOUS
42
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains numerous embedded URLs and a document body that attempts to lure users into downloading game-related hacks or cheats. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of it being used for malicious purposes, likely to distribute malware or facilitate scams. No scripts were extracted, but the presence of multiple suspicious URLs suggests a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9986
Heuristics 3
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://netcdn.xyz/app/431946152/how-to-change-your-username-on-roblox-for-free-game-hack PDF link annotation
- http://gc-sistemas.com.ar/images/https-iosgodscom-topic-20218flipmastercoinshack_GM406889139.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/coin-master-hack-mod-apk-download_GM406889139.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/free-roblox-toy-codes-2021_GM431946152.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/coin-master-hack-pro-gamers_GM406889139.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/how-to-hack-to-get-robux_GM431946152.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/minecraft-pvp-hacks_GM479516143.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/coin-master-link-spin_GM406889139.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/best-minecraft-hacked-client_GM479516143.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/roblox-com-r_GM431946152.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/free-robux-without-downloading-anything_GM431946152.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/roblox-jailbreak-hack_GM431946152.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/free-coins-for-coin-master_GM406889139.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/who-to-get-free-robux_GM431946152.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/coin-master-facebook-free-spins_GM406889139.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/free-op-minecraft-servers_GM479516143.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/how-to-get-free-robux-youtube_GM431946152.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/minecraft-hacker-skin_GM479516143.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/coin-master-spin-free_GM406889139.pdfIn PDF document text
- http://gc-sistemas.com.ar/images/coin-master-free-download-pc_GM406889139.pdfIn PDF document text
- http://192.168.0.99/%20%3Cp%3E%3Cp%3Ecomo%20hackear%20phantom%20forces%20roblox%202019%3Cp%3E%3Cp%3EWith%20the%20largest%20user%20generated%20online%20gaming%20platform%20and%20over%2015%20million%20games%20created%20by%20users%20roblox%20is%20the%201%20gaming%20site%20for%20kids%20and%20teens%20comscore.%20To%20make%20sure%20it%20you%20are%20able%20to%20ask%20about%20it%20to%20other%20roblox%20players%20who%20understand%20about%20it%20and%20who%20have%20played%20roblox%20for%20a%20long%20time.%3Cp%3E%3Cp%3EDSW%20items%20up%20to%2025%25%20off%20+%20Free%20P&P.%20Enter%20eBay%20discount%20to%20get%20at%20the%20lowest%20price%20while%20shopping%20online.%20Save%20big%20bucks%20w/%20this%20offer:%20DSW%20items%20up%20to%2025%25%20off%20+%20Free%20P&P.%20Available%20for%20shopping%20online.%20Expire%20Soon%20275%20used.%20Get%20Deal.%20Sale.%20Limited%20time%20sale:%20Dsw%20Coupons%20$20%20Off%20$49.%3Cp%3E%3Cp%3Eroblox%20free%20items%20generator%3Cp%3E%3Cp%3ERestaurant%20tycoon%20script.%20minwoo.%20Apr%2027th,%202019.%20if%20tycoon.Factory.Player.Value%20==%20game.Players.LocalPlayer%20then.%20talenthacker.js.%20C#%20%7C%2050%20min%20ago.%20Roblox%20DARK%20DEX%20v4.%3Cp%3E%3Cp%3E7%20Year%20Old%20Girls%20Avatar%20Assaulted%20While%20Playing%20Roblox%20Game.%20Saraderrs%20Avatar%20Creator%20Roblox.%20Avatar%20Editor%20For%20Android%20Apk%20Download.%20Roblox%20Responds%20To%20The%20Hack%20That%20Allowed%20A%20Childs%20Avatar%20To.%20132%20Best%20Roblox%20Characters%20Images%20In%202019%20Roblox%20Oof%20Cute.%3Cp%3E%3Cp%3Ehow%20to%20speed%20hack%20roblox%202017%3Cp%3E%3Cp%3ERoblox%20free%20faces%7C%20how%20to%20get%20free%20face%20on%20roblox!%20Watch%20this%20for%20Promo%20code%20In PDF document text
- https://www.mic...%3Cp%3E%3Cp%3Efree%20robux%20generator%202019%20no%20app%20download%3Cp%3E%3Cp%3ELin%20is%20one%20of%20several%20exclusive%20Roblox%20Avatars%20available%20for%20free!%20You%20can%20change%20your%20look%20at%20any%20time%20by%20selecting%20or%20buying%20a%20different%20avatar.%20In PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off00004d8b.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x4D8B | 22780 bytes |
SHA-256: f8134e02553eb5ff7d2a1fb42e4033dabfb5fea644b18c08d0df66f240d191c7 |
|||
font_01_sfnt_off000080a3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x80A3 | 19128 bytes |
SHA-256: 410c262f941ae5fb97195e2da4733f695299f1c81a3778f3c3158216d7164c10 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.