Malicious PDF — malware analysis report

Static analysis result for SHA-256 698676debbdd660e…

MALICIOUS

PDF

58.6 KB Created: 2021-04-06 01:10:22 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-04
MD5: f4b266e8f924b8a211c1c6ca5635d3e9 SHA-1: 9270a9019582fc7802c7cb9bc333a17266f75114 SHA-256: 698676debbdd660eaf9b5f90a8676ffd17113016349127adb93c4621757efabf
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF file contains heuristics indicating brand impersonation (Facebook) and a lure for credential phishing, specifically mentioning a "Chat Hack" and "Robux Generator". The embedded URL `http://gaminggenerator.org/app/431946152/chat-hack-roblox` is presented as a call-to-action, which is a common tactic for spearphishing attachments. The ML classifier also flagged the PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6397

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/chat-hack-roblox.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/chat-hack-roblox PDF link annotation
    • http://www.nielsen2u.dk/images/roblox-hack-2021-free-robux-generator-working-method-scratch.pdfIn PDF document text
    • https://www.najeebqasmi.com/images/how-to-get-free-robux-without-verification-2021.pdfIn PDF document text
    • https://millatgears.com/images/how-to-hack-in-roblox-2021.pdfIn PDF document text
    • https://luminouswisdom.org/images/how-to-get-free-robux-in-a-second.pdfIn PDF document text
    • http://tegeler-segler.de/images/roblox-builders-club-free-trial-2021.pdfIn PDF document text
    • http://www.eurosan1.ba/images/how-to-make-pants-for-free-in-roblox.pdfIn PDF document text
    • https://www.hbproducts.dk/images/2021-hacker-face-roblox.pdfIn PDF document text
    • https://www.romedia.gr/images/unpatchable-robux-hack-2021.pdfIn PDF document text
    • https://www.brainpads.com/images/roblox-conquerors-3-hack.pdfIn PDF document text
    • http://facingachild.org/images/preguntas-y-respuestas-roblox-robux-free.pdfIn PDF document text
    • http://jijel.info/images/robux-free-hack-no-survey-2021.pdfIn PDF document text
    • https://europe-upkl.eu/images/combo-free-roblox.pdfIn PDF document text
    • https://www.ghknights.org/images/dl-roblox-hack.pdfIn PDF document text
    • http://shahriyarclimb.com/images/roblox-hacks-strucid-aimbot.pdfIn PDF document text
    • http://zarinnameh.ir/images/unlimited-robux-hack-no-verification.pdfIn PDF document text
    • http://www.drent.se/images/free-robux-2021-generator-no-human-verification.pdfIn PDF document text
    • https://schulzpressetext.de/images/free-robux-nowcom.pdfIn PDF document text
    • http://nod74.ru/images/hack-1k-robux.pdfIn PDF document text
    • https://www.ukrtrans.biz/images/how-to-hack-roblox-sites.pdfIn PDF document text
    • https://studentcareerinfo.com/images/heroes-online-roblox-hack.pdfIn PDF document text
    • http://nevesomost.by/images/robux-hacks-real.pdfIn PDF document text
    • http://ff-obertraun.at/images/how-to-hack-games-on-roblox-rpg-rainbow-swords-rpg.pdfIn PDF document text
    • http://www.exikom.com.ua/images/how-to-get-free-robux-april-2021.pdfIn PDF document text
    • http://www.marambio.com.ar/images/roblox-trade-currency-hack.pdfIn PDF document text
    • https://www.iadh.bi/images/hack-de-roblox-robux-espaol.pdfIn PDF document text
    • http://ukrainiansofbuffalo.com/images/kazok-free-robux-hack.pdfIn PDF document text
    • https://www.osoc.com/images/roblox-admin-script-hack-pastebin.pdfIn PDF document text
    • http://aimp-market.ru/images/free-roblox-gift-card-codes-2021-no-human-verification.pdfIn PDF document text
    • http://behsanroshd.com/images/free-robux-every-day.pdfIn PDF document text
    • https://consorziocsa-asicaivano.it/images/roblox-free-download.pdfIn PDF document text
    • http://sandra-masemann.de/images/free-roblox-phantom-forces-hacks.pdfIn PDF document text
    • http://xn-----clcdhzcbmgnochhb1boe1a6b.xn--p1ai/images/roblox-hack-generator-no-human-verification.pdfIn PDF document text
    • http://www.visiblefilm.com/images/how-to-get-robux-for-free-on-roblox-2021.pdfIn PDF document text
    • http://zarinnameh.ir/images/free-robux-youtube-denis.pdfIn PDF document text
    • http://darruzzo.com/images/clickme-roblox-giving-free-robux.pdfIn PDF document text
    • http://soma.com.ua/images/venom-cheats-roblox.pdfIn PDF document text
    • http://learningarabic.co.uk/images/free-robux-accounts-2021.pdfIn PDF document text
    • http://safeandsecurelocksmith.ca/images/free-robux-generator-ohne-handynummer.pdfIn PDF document text
    • http://greasley.online/images/redeem-robux-codes-free.pdfIn PDF document text
    • http://butkimloai.com/images/clash-royale-legendary-cards-hack-roblox.pdfIn PDF document text
    • http://ims-77.fr/images/icon-free-robux.pdfIn PDF document text
    • http://ghegamethu.vn/images/free-robux-cpdes.pdfIn PDF document text
    • http://finettifrs.it/images/command-hacks-for-roblox.pdfIn PDF document text
    • http://j-cook.pro/images/site-to-have-free-robux.pdfIn PDF document text
    • http://junktiquecollector.com/images/como-hackear-a-tu-amigo-en-roblox.pdfIn PDF document text
    • http://baah.ca/images/dragon-ball-x-in-roblox-hack.pdfIn PDF document text
    • http://fm-express.de/images/roblox-cheat-com.pdfIn PDF document text
    • http://www.gadanie.lv/images/free-robux-no-human-verification-and-no-survey-2021.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/free-robux-limited-offer-game-answers.pdfIn PDF document text
    +17 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00008040.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8040 25048 bytes
SHA-256: cca93df6375b9a18e029779eda4c1ea2c4f3a28f63b447c98ca00d17ede89023
font_01_sfnt_off0000b9e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9E8 2832 bytes
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2
font_02_sfnt_off0000c398.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC398 17540 bytes
SHA-256: 715e90e81f19de872958f07ec624d687a3b79ce0fb62bd912b0c34973240384a

Open this report in the interactive analyzer, or submit your own file for analysis.