Malicious PDF — malware analysis report

Static analysis result for SHA-256 01af200adc336c0c…

MALICIOUS

PDF

45.4 KB Created: 2021-04-02 22:52:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-01
MD5: db82b1d5163735b19db8e2b1d6fd6169 SHA-1: dfd6900c7c2f41a4adad2756e5b4e757f2fa8991 SHA-256: 01af200adc336c0c735d3e62f0ef64214687ebee05b6c71f30688555ecbcb5fa
72 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9434

Heuristics 4

  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/hack-robux-with-inspect PDF link annotation
    • https://sitam.co.in/images/free-roblox-accounts-with-builders-club-2021.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/roblox-hacking-tools-reddit.pdfIn PDF document text
    • http://www.occquimica.com.br/images/hack-roblox-2021-february.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/moon-tycoon-roblox-this-game-gives-you-free-robux.pdfIn PDF document text
    • https://esl.ipb.ac.id/images/hack-pp-jailbreak-roblox.pdfIn PDF document text
    • https://corbo.ru/images/free-robux-code-21-01-2021.pdfIn PDF document text
    • http://www.rezbb.sk/images/roblox-free-items-generator-hack.pdfIn PDF document text
    • http://www.vktzunami.cz/images/descargar-roblox-hackeado-para-android.pdfIn PDF document text
    • http://www.cosver.nl/images/roblox-hack-sharder.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/how-to-get-free-robux-2021-august.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/how-to-get-easy-robux-for-free.pdfIn PDF document text
    • http://www.copoint.co.uk/images/take-me-to-get-free-robux.pdfIn PDF document text
    • http://www.fluidtech.hu/images/roblox-scripters-for-free.pdfIn PDF document text
    • http://bilhetim.com.br/images/cheat-engine-bypass-roblox-2021.pdfIn PDF document text
    • https://www.porthos.it/images/free-code-roblox-animation.pdfIn PDF document text
    • http://poltekkeskhjogja.ac.id/images/roblox-hack-script-booga-booga.pdfIn PDF document text
    • http://www.pcclawyers.com.au/images/how-to-change-your-name-for-free-roblox.pdfIn PDF document text
    • https://www.abrapppe.org.br/images/how-to-get-free-robux-2021.pdfIn PDF document text
    • http://www.vktzunami.cz/images/hacks-deathnote-roblox.pdfIn PDF document text
    • https://bancroftandsons.com/images/free-robux-rixty-codes.pdfIn PDF document text
    • http://www.nielsen2u.dk/images/roblox-hacker-arrested.pdfIn PDF document text
    • http://sscclc.edu.ec/images/free-roblox-game-card.pdfIn PDF document text
    • http://www.torvet11.dk/images/hacked-roblox-servers.pdfIn PDF document text
    • https://www.hotschool.com.au/images/game-kit-roblox-800-robux-for-free.pdfIn PDF document text
    • https://www.sinaloadiario.mx/images/the-underground-war-roblox-cheats.pdfIn PDF document text
    • http://cosver.eu/images/how-to-get-free-robux-on-roblox-xbox-one.pdfIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/free-rs-roblox.pdfIn PDF document text
    • https://technospektr.com.ua/images/roblox-cash-free.pdfIn PDF document text
    • http://legs11.co.za/images/hacks-tools-para-roblox.pdfIn PDF document text
    • http://www.vktzunami.cz/images/roblox-working-robux-hack.pdfIn PDF document text
    • http://bilhetim.com.br/images/free-rixty-codes-for-robux.pdfIn PDF document text
    • http://www.hawler.in/images/roblox-app-cheat-engine.pdfIn PDF document text
    • http://www.cosver.nl/images/free-robux-2021-no-offiers.pdfIn PDF document text
    • https://www.air-shop.cz/images/roblox-best-free-exploits.pdfIn PDF document text
    • https://www.stkdb.cz/images/sex-hack-roblox.pdfIn PDF document text
    • http://nosocomium.rv.ua/images/how-to-get-free-tbc-on-roblox-2021.pdfIn PDF document text
    • http://svp-steinmaur.ch/images/roblox-jailbreajk-new-hack.pdfIn PDF document text
    • http://www.zdravazena.sk/images/free-robux-hack-trackid-sp006.pdfIn PDF document text
    • http://zarinnameh.ir/images/get-free-absol-egg-brick-bronse-roblox.pdfIn PDF document text
    • http://echosvoix.ch/images/roblox-cheat-engine-download-for-mac.pdfIn PDF document text
    • http://www.zdravazena.sk/images/roblox-walking-through-wall-hacks.pdfIn PDF document text
    • http://www.zdravazena.sk/images/how-to-report-cheats-on-roblox.pdfIn PDF document text
    • http://www.mjclautrec.fr/images/roblox-cheat-seven-v2.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/roblox-how-to-get-everything-free-in-the-catalog.pdfIn PDF document text
    • https://estalagemmonteverde.com.br/images/how-to-get-furniture-for-free-on-roblox-highschool.pdfIn PDF document text
    • http://www.drent.se/images/ebay-free-roblox-accounts.pdfIn PDF document text
    • http://escolaarboc.cat/images/free-roblox-audio-sounds-songs.pdfIn PDF document text
    • http://www.fanciullovito.it/images/cheat-engine-hack-roblox-speed.pdfIn PDF document text
    • http://www.anies.eu/images/cosas-free-en-roblox.pdfIn PDF document text
    +2 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000557f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x557F 24532 bytes
SHA-256: f8c80084b6d543f8bb5ca6db50b7f9042b1c842be0e94fb9a3fb14300119563f
font_01_sfnt_off00008c01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C01 18584 bytes
SHA-256: de3afc6e10389bc83a895032766ae201b2824e1161557033bf360928b6af5a1e