Malicious PDF — malware analysis report

Static analysis result for SHA-256 22478289148005ea…

MALICIOUS

PDF

35.2 KB Created: 2021-04-05 17:35:27 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-04-22
MD5: ebf2f04bf30e1f4d47abd5a04c7e8db8 SHA-1: a91ceaed0aea6b7621cc0aea7a0ca017ffcb6ddc SHA-256: 22478289148005ea60522088057614d5b078bee7a21d6a6b11c09c0d72ac3e5f
132 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-robux-generator-no-survey-2021 PDF link annotation
    • http://www.das-kinderzimmer.net/images/robux-case-hack-roblox-pastebin.pdfIn PDF document text
    • https://europe-upkl.eu/images/hack-for-counter-blox-roblox.pdfIn PDF document text
    • https://asesoriamss.com/images/new-cheat-roblox.pdfIn PDF document text
    • https://jsgwertherborgholzhausen.de/images/hacks-to-get-money-on-roblox.pdfIn PDF document text
    • https://lobergetart.se/images/roblox-troll-script-hack-pastebin.pdfIn PDF document text
    • https://www.vacationrentalsincroatia.com/images/how-to-hack-robux-on-windows.pdfIn PDF document text
    • http://kaleasm.org/images/roblox-jailbreak-download-hack.pdfIn PDF document text
    • http://lechia-sedziszow.pl/images/robux-free-2021.pdfIn PDF document text
    • http://egorplitka.ru/images/tablet-hacks-roblox.pdfIn PDF document text
    • http://kulturlandschaften.eu/images/how-to-speed-hack-roblox-cheat-engine.pdfIn PDF document text
    • https://laconce.com/images/gainblox-gg-robux-free.pdfIn PDF document text
    • http://homequeen.de/images/free-guest-roblox.pdfIn PDF document text
    • http://ehma.com/images/how-to-get-free-robux-denisdaily.pdfIn PDF document text
    • http://www.pleiadisrl.it/images/hacks-for-roblox-trackid.pdfIn PDF document text
    • http://krymtorg-r.ru/images/how-to-hack-games-on-roblox-2021.pdfIn PDF document text
    • https://www.knxuk.org/images/all-roblox-dance-hacks.pdfIn PDF document text
    • https://www.audev.com/images/roblox-account-hacked-crying.pdfIn PDF document text
    • https://www.ukrtrans.biz/images/free-robux-website-without-human-verification.pdfIn PDF document text
    • http://kim-kinder-im-mittelpunkt.de/images/free-roblox-gamecards-secret-codes.pdfIn PDF document text
    • http://innovativefs.co.uk/images/roblox-blockburg-money-hack-penquin-gui-script.pdfIn PDF document text
    • http://grupodin.com.br/images/noob-vs-pro-vs-hacker-vs-god-w-roblox-waiting.pdfIn PDF document text
    • http://bibliodetki.ru/images/how-to-get-free-robux-without-verifications.pdfIn PDF document text
    • http://boliviagasenergia.com/images/now-speed-hack-roblox.pdfIn PDF document text
    • http://beagles-of-harmony.de/images/roblox-free-bodys.pdfIn PDF document text
    • http://wcasrock.org/images/how-do-you-hack-money-on-roblox.pdfIn PDF document text
    • https://kimolos-link.gr/images/free-roblox-accounts-with-robux-not-banned.pdfIn PDF document text
    • http://www.bbnest.it/images/free-robux-without-any-human-verification.pdfIn PDF document text
    • http://erptrends.com/images/a-promo-code-that-gives-us-free-robux-no-waiting.pdfIn PDF document text
    • http://hydroconseil.net/images/event-ykm-simlatr-roblox-hack.pdfIn PDF document text
    • http://firstaidacademy.be/images/find-free-download-of-roblox-zombie-rush-for-windows7.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00003d21.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D21 19348 bytes
SHA-256: 01be2eeb4efb753ed1b869ebca79ebe16b1c9e431b7e3463f36b94aefa6882c8
font_01_sfnt_off00006592.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6592 18436 bytes
SHA-256: 5f6b35c6cb0a19f0ea81428a32d0aebfa5a150bd54e2b2bc4e07335421f880df