MALICIOUS
172
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains numerous links and text promoting free items and hacks for the game Roblox, which is a common lure for phishing and scam websites. The heuristic firings indicate a link farm designed to redirect users to potentially malicious sites. The presence of a QR business process lure suggests a social engineering attempt to trick users into scanning a code, likely leading to a malicious payload or phishing page.
Machine Learning
- Nyx PDF Classifier malicious score 0.9725
Heuristics 6
-
PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARMPDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
-
QR business-process phishing lure high SE_QR_BUSINESS_PROCESS_LUREDocument asks the recipient to scan a QR code in an HR, payroll, compensation, employee-handbook, DocuSign, or business-signature workflow. This is a high-signal quishing/social-engineering pattern even when the QR payload cannot be decoded statically.
-
PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARMPDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/free-clothes-and-hats-on-roblox PDF link annotation
- http://www.zdravazena.sk/images/play-robloxcom-free.pdf%0AIn PDF document text
- https://www.air-shop.cz/images/nicsterv-roblox-hackers.pdf%0AIn PDF document text
- http://echosvoix.ch/images/bear-hack-roblox.pdf%0AIn PDF document text
- http://stroygrad-spb.com/images/roblox-how-to-get-free-robu.pdf%0AIn PDF document text
- https://www.romedia.gr/images/i-got-this-shirt-for-free-roblox.pdf%0AIn PDF document text
- https://www.najeebqasmi.com/images/dracosword-roblox-hacker.pdf%0AIn PDF document text
- http://poltekkeskhjogja.ac.id/images/version-hacker-de-roblox.pdf%0AIn PDF document text
- https://www.audev.com/images/superhros-roblox-free.pdf%0AIn PDF document text
- https://www.coriglianocalabro.it/images/rob-hacker-robux-generator.pdf%0AIn PDF document text
- http://domaizdereva24.ru/images/youtube-how-to-get-free-robux-2021.pdf%0AIn PDF document text
- http://uctovnictvosnv.sk/images/games-on-roblox-with-free-radios.pdf%0AIn PDF document text
- http://www.actae.gr/images/how-to-get-robux-with-cheat-engine-2021.pdf%0AIn PDF document text
- http://www.hawler.in/images/roblox-hack-robux-2021-no-human-verification.pdf%0AIn PDF document text
- https://www.fhccu.com/images/free-robux-using-javascript.pdf%0AIn PDF document text
- http://aeroclub-kaernten.at/images/roblox-shirt-maker-download-free.pdf%0AIn PDF document text
- http://www.evaplast.by/images/royale-high-roblox-diamond-hack.pdf%0AIn PDF document text
- https://sitam.co.in/images/roblox-account-selling-free.pdf%0AIn PDF document text
- http://kids-academy.pl/images/promo-codes-for-free-stuff-2021-roblox.pdf%0AIn PDF document text
- http://www.zdravazena.sk/images/roblox-animatronic-world-hack.pdf%0AIn PDF document text
- http://www.sapaengineering.kz/images/how-to-get-free-faces-on-roblox-2021.pdf%0AIn PDF document text
- https://www.fhccu.com/images/mc-the-miner-free-robux.pdf%0AIn PDF document text
- https://www.wildpark-johannismuehle.de/images/roblox-hack-scrip.pdf%0AIn PDF document text
- https://www.osoc.com/images/how-to-hack-any-game-on-roblox-with-cheat-engine.pdf%0AIn PDF document text
- https://www.millatgears.com/images/free-points-for-robux-easy-to-get.pdf%0AIn PDF document text
- https://www.foodsafety.cz/images/play-game-for-free-robux.pdf%0AIn PDF document text
- http://www.mikramarine.gr/images/auto-clicker-for-roblox-mac-free.pdf%0AIn PDF document text
- https://www.abrapppe.org.br/images/jp-youtube-roblox-how-to-get-free-robux.pdf%0AIn PDF document text
- http://www.evaplast.by/images/how-to-cheat-in-dna-on-ds-roblox.pdf%0AIn PDF document text
- https://technospektr.com.ua/images/free-robux-sign-up.pdf%0AIn PDF document text
- https://esl.ipb.ac.id/images/does-account-stealing-hack-roblox-work.pdf%0AIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00003394.bin)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003394.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3394 | 20088 bytes |
SHA-256: d6940db2269fb34ec26f81f4af475d82f289f6ba3cab3d2007e47e9f6bdc4a08 |
|||
font_01_sfnt_off00005cc5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5CC5 | 18208 bytes |
SHA-256: b61d6abde3bd21ea43e717495af60bfb81fa332266562ed00a38681616eae1a4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.