PDF static analysis report

Static analysis result for SHA-256 4e387c4b877a96d5…

SUSPICIOUS

PDF

39.8 KB Created: 2021-04-03 20:00:56 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-19
MD5: 4959c2296395734b4acdfa4dedd7d376 SHA-1: 7bd7d770d92069a01c7f57c0e401b71aa473189a SHA-256: 4e387c4b877a96d5689c928ad5d2613e3af42155c8e0c121d9daedce1588931d
42 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-free-templates-blank PDF link annotation
    • https://www.porthos.it/images/free-robux-generator-2021-hack.pdf%0AIn PDF document text
    • http://bilhetim.com.br/images/download-a-free-gater-for-robux-generator.pdf%0AIn PDF document text
    • https://www.audev.com/images/how-to-hack-roblox-on-ipad-to-get-robux.pdf%0AIn PDF document text
    • http://cosver.eu/images/roblox-free-purple-eye-galsse.pdf%0AIn PDF document text
    • http://www.lovecraftiana.com.ar/images/roblox-apk-hack-2021.pdf%0AIn PDF document text
    • https://verdensbarn.no/images/basic-roblox-lua-programming-free.pdf%0AIn PDF document text
    • http://domaizdereva24.ru/images/roblox-btools-hack-august.pdf%0AIn PDF document text
    • http://www.marambio.com.ar/images/roblox-juwelen-hack-mad-paintball-2.pdf%0AIn PDF document text
    • http://www.nielsen2u.dk/images/code-cheat-card-roblox.pdf%0AIn PDF document text
    • http://www.boic.nl/images/apk-roblox-hack-pc.pdf%0AIn PDF document text
    • https://www.ghknights.org/images/free-roblox-accounts-november-2021.pdf%0AIn PDF document text
    • http://kruiz21.ru/images/free-paid-roblox-guis.pdf%0AIn PDF document text
    • https://www.dierenartsberghman.be/images/free-robux-2021-hack.pdf%0AIn PDF document text
    • http://www.mjclautrec.fr/images/roblox-free-robux-codes-http-bitly-robloxinstantapp.pdf%0AIn PDF document text
    • http://www.pcclawyers.com.au/images/how-to-get-free-diamonds-in-roblox-royale-high-school.pdf%0AIn PDF document text
    • https://www.cpnf.ch/images/comment-cheat-sur-roblox-retail-tycoon.pdf%0AIn PDF document text
    • https://www.utalii.ac.ke/images/how-to-get-5-robux-for-free-2021.pdf%0AIn PDF document text
    • http://www.exikom.com.ua/images/how-to-get-free-roblox-skins.pdf%0AIn PDF document text
    • http://www.maakherumusic.net/images/free-accounts-for-roblox-with-robux-2021.pdf%0AIn PDF document text
    • http://legs11.co.za/images/free-robux-no-human-verification-or-survey-2021-for-kids.pdf%0AIn PDF document text
    • http://echosvoix.ch/images/2021-free-robux-game.pdf%0AIn PDF document text
    • https://www.ncscolour.no/images/free-draw-2-roblox-script.pdf%0AIn PDF document text
    • https://www.abrapppe.org.br/images/roblox-phantom-forces-money-hack-2021.pdf%0AIn PDF document text
    • https://www.stkdb.cz/images/roblox-mad-city-hack-2021.pdf%0AIn PDF document text
    • https://www.air-shop.cz/images/roblox-free-rthro-packages.pdf%0AIn PDF document text
    • http://echosvoix.ch/images/free-how-to-get-free-robux.pdf%0AIn PDF document text
    • http://ns1.radiofacil.net/images/androidp1com-hack-robux.pdf%0AIn PDF document text
    • http://www.ntc.edu.za/images/cheat-codes-for-roblox-prison-life.pdf%0AIn PDF document text
    • https://www.lomrad.go.th/images/roblox-free-robux-by-roblox.pdf%0AIn PDF document text
    • http://www.cbgp.upm.es/images/caillou-hack-roblox.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
🗂 Part of campaign: escolaarboc.cat 3 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004379.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4379 23176 bytes
SHA-256: c0099484d5258dd826203e2ea84a56fdd17a95b4f9b2df630cb6392b9be8fd78
font_01_sfnt_off000077d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x77D7 18472 bytes
SHA-256: 20b43dccf0f6cbbc6de655c5d08dbf3bbc79726cc0f3be216056185b584c723e