MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous embedded links, many of which are repeated and disguised as download buttons or related to game cheats. The heuristic 'PDF_REPEATED_PAYLOAD_LINK_LURE' specifically indicates that these invisible links are intended to deliver a payload. The document body and extracted URLs suggest a lure related to 'Robux' generators and game hacks, aiming to trick users into downloading malicious files.
Machine Learning
- Nyx PDF Classifier malicious score 0.6365
Heuristics 3
-
Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LUREPDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/vido-roblox-free-robux-generator.com In PDF document text
- http://www.it-ro.it/images/free-roblox-promo-codes-2021-not-expired.pdfIn PDF document text
- https://www.cosmosdawn.net/images/who-to-email-when-your-roblox-account-is-hacked.pdfIn PDF document text
- http://onlinemusicsolutions.com.au/images/roblox-hack-site-free-robux-2021.pdfIn PDF document text
- http://ralf-gryga.de/images/free-to-use-roblox-accounts.pdfIn PDF document text
- http://hondenspecialist-engelien.nl/images/free-roblox-accounts-with-robux-2021.pdfIn PDF document text
- http://horsa18.ru/images/get-free-robux-generator-parts-pokemon-silver.pdfIn PDF document text
- http://www.thecoffeebaron.co.za/images/free-draw-2-alpha-roblox.pdfIn PDF document text
- http://www.htc.edu.au/images/roblox-hacker-on-urbis.pdfIn PDF document text
- https://www.elevage-chiot.fr/images/200-robux-free.pdfIn PDF document text
- https://schulzpressetext.de/images/cheat-engine-keeps-getting-me-kicked-roblox.pdfIn PDF document text
- http://huounaixunghe.com/images/one-piece-millenium-roblox-found-a-hacki-book.pdfIn PDF document text
- http://www.torvet11.dk/images/money-hack-restaurant-tycoon-roblox.pdfIn PDF document text
- http://solidkom.ch/images/sparereborn-roblox-hacks.pdfIn PDF document text
- http://www.friendshiptransport.net/images/descargar-hack-de-jailbreak-roblox.pdfIn PDF document text
- http://genialica.de/images/how-to-sell-items-for-robux-for-free-roblox.pdfIn PDF document text
- https://bancroftandsons.com/images/blue-stacks-robux-hack.pdfIn PDF document text
- https://www.poiskavia.ru/images/free-roblox-adopt-me-money.pdfIn PDF document text
- http://androidthai.in.th/images/prison-royale-roblox-hack.pdfIn PDF document text
- http://eddegrootassurantien.nl/images/free-robux-no-downloads-needed.pdfIn PDF document text
- https://uofk.edu/images/codes-for-free-sp-in-ice-cream-simulator-roblox.pdfIn PDF document text
- https://www.mrsz.ir/images/roblox-blue-aldias-tshirt-free.pdfIn PDF document text
- http://instrumenttut.by/images/aimbot-fro-roblox-download-free.pdfIn PDF document text
- http://www.occquimica.com.br/images/take-anyones-robux-robuxian-hack.pdfIn PDF document text
- http://geometraperiotto.it/images/como-descargarse-hacks-en-roblox-jailbreak-agosto-2021.pdfIn PDF document text
- http://behsanroshd.com/images/hacks-for-roblox-mining-simulator.pdfIn PDF document text
- http://fratellimazzoleni.it/images/roblox-hcks.pdfIn PDF document text
- http://omahahospitalityhalloffame.org/images/roblox-hack-999999-robux-ios.pdfIn PDF document text
- http://lechia-sedziszow.pl/images/robux-hack-apk-2021.pdfIn PDF document text
- http://www.learningbydoinglingue.com/images/code-get-free-robux-roblox.pdfIn PDF document text
- http://gestibrok.com/images/games-on-roblox-that-give-free-robux.pdfIn PDF document text
- https://www.cosmosdawn.net/images/who-to-email-when-your-In PDF document text
- http://ralf-gryga.de/images/free-In PDF document text
- http://horsa18.ru/images/get-In PDF document text
- http://huounaixunghe.com/images/one-piece-millenium-In PDF document text
- https://uofk.edu/images/codes-for-free-sp-in-ice-cream-simulator-In PDF document text
- http://geometraperiotto.it/images/como-descargarse-hacks-en-In PDF document text
- http://fratellimazzoleni.it/images/roblox-In PDF document text
- http://lechia-sedziszow.pl/images/robux-hack-apk-In PDF document text
- http://gestibrok.com/images/games-on-roblox-that-give-In PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00006c9b.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x6C9B | 26676 bytes |
SHA-256: 7af9b3becf3e84ded6e2b43846644285c1b4ea000fda6c8b1f83a723f2520193 |
|||
font_01_sfnt_off0000a882.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA882 | 2832 bytes |
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2 |
|||
font_02_sfnt_off0000b233.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB233 | 18708 bytes |
SHA-256: 923d54c1bed63a50d7894786b9d6024bdd6e6088171407ce1a5787e18be51118 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.