MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of embedded URLs that lead to websites offering game hacks and free in-game currency, indicative of a scam or phishing operation. The heuristic firings strongly suggest this is a link farm designed to redirect users to malicious sites. No scripts were extracted, but the document's structure and content point towards a social engineering attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9500
Heuristics 5
-
PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARMPDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
-
PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARMPDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/roblox-cheat-engine-work-at-a-pizza-place PDF link annotation
- http://www.remiauclair.fr/images/funny-hacker-scripts-roblox.pdf%0AIn PDF document text
- http://ff-obertraun.at/images/free-robux-websites-no-scam.pdf%0AIn PDF document text
- http://www.tamogatoweb.hu/images/roblox-hacking-script-hub.pdf%0AIn PDF document text
- https://esl.ipb.ac.id/images/hacks-para-arsenal-roblox.pdf%0AIn PDF document text
- https://www.stkdb.cz/images/free-black-wings-roblox.pdf%0AIn PDF document text
- https://www.academiaanticorrupcion.org/images/dance-cheats-for-roblox.pdf%0AIn PDF document text
- https://pemadamapi.net/images/new-hack-for-roblox-deathrun-2021-november-pc.pdf%0AIn PDF document text
- https://gomsa.nl/images/how-to-get-free-robux-june-2021.pdf%0AIn PDF document text
- https://www.saisystem.it/images/online-robux-hack-no-download.pdf%0AIn PDF document text
- https://www.audev.com/images/how-to-install-hacks-for-roblox.pdf%0AIn PDF document text
- http://uctovnictvosnv.sk/images/how-to-earn-free-robux-no-human-verification.pdf%0AIn PDF document text
- https://www.utalii.ac.ke/images/roblox-synapse-free-download.pdf%0AIn PDF document text
- http://portal.crfsp.org.br/images/roblox-dinosaur-simulator-hack-2021.pdf%0AIn PDF document text
- https://www.ncscolour.no/images/how-to-get-1-billion-free-robux.pdf%0AIn PDF document text
- http://pa-tanjungselor.go.id/images/roblox-hack-peoples-account-2021.pdf%0AIn PDF document text
- http://www.drent.se/images/free-robux-no-siging-i-n.pdf%0AIn PDF document text
- https://www.cpnf.ch/images/how-to-remove-default-clothing-for-free-roblox.pdf%0AIn PDF document text
- https://pemadamapi.net/images/city-life-man-roblox-free.pdf%0AIn PDF document text
- http://www.visiblefilm.com/images/free-roblox-invitations-loadstrings-full-lua.pdf%0AIn PDF document text
- https://www.lomrad.go.th/images/free-tix-roblox-2021.pdf%0AIn PDF document text
- http://escolaarboc.cat/images/speed-hack-roblox-ccv3-2021.pdf%0AIn PDF document text
- https://www.beaufortcollege.ie/images/dominus-in-roblox-free.pdf%0AIn PDF document text
- http://www.actae.gr/images/roblox-free-hoodie-template.pdf%0AIn PDF document text
- https://jdlgroup.ca/images/free-promo-codes-roblox-for-robux.pdf%0AIn PDF document text
- https://www.eglihotel.gr/images/free-robux-mega-gift.pdf%0AIn PDF document text
- http://echosvoix.ch/images/how-to-wall-hack-in-jailbreak-roblox.pdf%0AIn PDF document text
- https://consorziocsa-asicaivano.it/images/flob-fun-robux-hack.pdf%0AIn PDF document text
- https://www.romedia.gr/images/roblox-hack-menu-download.pdf%0AIn PDF document text
- http://www.occquimica.com.br/images/forum-comment-cheat-sur-roblox.pdf%0AIn PDF document text
- http://www.exikom.com.ua/images/how-to-hack-roblox-for-robux-on-computer.pdf%0AIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off0000458b.bin)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off0000458b.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x458B | 23908 bytes |
SHA-256: 5940de76f8195c3964f614913bbb3379287172af039a50ada2e23fafdfc64007 |
|||
font_01_sfnt_off00007be6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7BE6 | 18828 bytes |
SHA-256: b68240b85ed877f65b3bcba1c33d3813e7e671e3cafa1bd7a6a4eb4fb9da108e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.