Malicious PDF — malware analysis report

Heuristics 6

• PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
  PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
  PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
• Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
  Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://gaminggenerator.org/app/431946152/how-to-get-roblox-bc-for-free PDF link annotation

  • http://www.hawler.in/images/good-roblox-games-to-hack.pdf%0AIn PDF document text
  • https://www.ghknights.org/images/roblox-outrageous-builders-club-for-free.pdf%0AIn PDF document text
  • https://www.ghknights.org/images/roblox-grand-blox-auto-2-all-cmds-hack.pdf%0AIn PDF document text
  • http://ff-obertraun.at/images/cmd-hack-roblox-jailbreak.pdf%0AIn PDF document text
  • https://hbln.org.au/images/roblox-doge-head-free.pdf%0AIn PDF document text
  • http://www.fluidtech.hu/images/how-to-cheat-in-guess-the-song-roblox.pdf%0AIn macro / runtime command snippet
  • http://www.boic.nl/images/caught-my-girlfriend-cheating-in-roblox-online-dating.pdf%0AIn PDF document text
  • https://socialvalue.gr/images/robux-hack-deutsch-pc.pdf%0AIn PDF document text
  • https://www.u-pin-it.com/images/hack-bee-swarm-simulator-roblox.pdf%0AIn PDF document text
  • http://www.marambio.com.ar/images/roblox-robux-online-hack.pdf%0AIn PDF document text
  • https://www.elevage-chiot.fr/images/lego-roblox-hacking.pdf%0AIn PDF document text
  • https://accord.kiev.ua/images/roblox-robux-hack-online-no-survey.pdf%0AIn PDF document text
  • https://www.lomrad.go.th/images/how-to-get-free-robux-on-macbook-air.pdf%0AIn PDF document text
  • https://www.stkdb.cz/images/giftcards-roblox-free.pdf%0AIn PDF document text
  • https://www.saisystem.it/images/free-robux-codes-pastebin.pdf%0AIn PDF document text
  • https://corbo.ru/images/free-robux-cheats-without-human-verification.pdf%0AIn PDF document text
  • http://pa-tanjungselor.go.id/images/roblox-fashion-famous-free-game.pdf%0AIn PDF document text
  • http://www.torvet11.dk/images/hack-para-counter-blox-roblox-offensive.pdf%0AIn PDF document text
  • https://verdensbarn.no/images/los-hacker-mas-famosos-de-roblox.pdf%0AIn PDF document text
  • http://www.web.stc-part.co.th/images/how-to-hack-dantdm-on-roblox.pdf%0AIn PDF document text
  • http://www.sapaengineering.kz/images/how-to-get-free-robux-on-roblox-2021.pdf%0AIn PDF document text
  • https://www.foodsafety.cz/images/abs-shirt-roblox-free.pdf%0AIn PDF document text
  • http://domaizdereva24.ru/images/www-robux-hack.pdf%0AIn PDF document text
  • http://www.hawler.in/images/how-to-download-roblox-hack-v65.pdf%0AIn PDF document text
  • http://svp-steinmaur.ch/images/high-school-life-hack-roblox.pdf%0AIn PDF document text
  • http://www.drent.se/images/5-free-roblox.pdf%0AIn PDF document text
  • https://ballaratcaravans.com.au/images/roblox-cheat-speed.pdf%0AIn PDF document text
  • https://tokunfome.com.br/images/make-free-robux-promo-codes.pdf%0AIn PDF document text
  • http://www.copoint.co.uk/images/citizen-free-robux.pdf%0AIn PDF document text
  • https://technospektr.com.ua/images/roblox-free-robux-no-real-money.pdf%0AIn PDF document text
  • https://hbln.org.au/images/In macro / runtime command snippet
  • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00004408.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.