Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a4cf5bf43c17d88…

MALICIOUS

PDF

244.8 KB Created: 2021-04-04 11:07:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-04
MD5: b690768e29a64fb30ba975b8e4e3b785 SHA-1: 017ff189a567968ac4cc2683606402adbbf4a489 SHA-256: 6a4cf5bf43c17d88cb230968dfb2923af1028d61dfc8ee0660ade659f274c9c2
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with a specific phishing signature related to Roblox cheats. The document body, though heavily obfuscated, contains references to 'Dragon Ball Rage Roblox Cheat Engine Hack' and the embedded URI points to a similar download lure. This suggests the document is designed to trick users into downloading potentially malicious software disguised as game cheats.

Machine Learning

  • Nyx PDF Classifier clean score 0.1227

Heuristics 4

  • ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/dragon-ball-rage-roblox-cheat-engine-hack PDF link annotation
    • http://kancelaria-legnica.eu/images/how-to-get-free-robux-on-roblox-no-builders-club.pdfIn PDF document text
    • https://asesoriamss.com/images/free-robux-generator-for-xbox-one-no-verification.pdfIn PDF document text
    • http://elllanorestaurants.com/images/nuevos-hacks-de-roblox-2021.pdfIn PDF document text
    • http://leigraphics.com/images/tower-of-hell-roblox-hack.pdfIn PDF document text
    • http://modlingua.com/images/fencing-reach-hack-roblox.pdfIn PDF document text
    • https://www.stkdb.cz/images/how-to-hack-roblox-and-get-meep-city-coins-fast.pdfIn PDF document text
    • https://www.sitiwebjoomla.it/images/get-free-robux-on-android.pdfIn PDF document text
    • http://ernstgloves.co.il/images/roblox-hack-2021-no-human-verification.pdfIn PDF document text
    • http://yogaschooldecypres.be/images/roblox-toy-codes-free-2021-jan.pdfIn PDF document text
    • http://www.apocalissedigesucristo.com/images/hack-fhantom-forces-roblox.pdfIn PDF document text
    • https://www.mvp.co.nz/images/roblox-robux-codes-hack-download-pc.pdfIn PDF document text
    • https://www.cosmosdawn.net/images/how-to-get-free-tix-on-roblox-no-hack.pdfIn PDF document text
    • http://tecnodue.com/images/how-to-hack-a-roblox-server-and-save-it.pdfIn PDF document text
    • http://belagrogen.by/images/how-to-get-free-robux-and-tix-using-inspect-element.pdfIn PDF document text
    • http://bibliotheque-perrigny-les-dijon.fr/images/http-robux-free-in.pdfIn PDF document text
    • https://www.ausecus.com/images/roblox-jailbreak-hack-pay.pdfIn PDF document text
    • http://pourvosvacances.com/images/roblox-admin-hack-pastebin.pdfIn PDF document text
    • https://www.saisystem.it/images/is-there-a-free-way-to-change-roblox-name.pdfIn PDF document text
    • http://imp.lg.ua/images/mad-fucker-roblox-hack.pdfIn PDF document text
    • http://arch-centr.ru/images/startingsploit-roblox-hack-download.pdfIn PDF document text
    • https://www.ghknights.org/images/how-to-get-money-on-roblox-with-cheat-engine-63.pdfIn PDF document text
    • http://techmobil.pl/images/robux-free-gift-card-org-generator.pdfIn PDF document text
    • http://dennemaat.nl/images/roblox-yin-vs-yang-cheat.pdfIn PDF document text
    • http://solidkom.ch/images/roblox-how-to-hack-phantom-forces.pdfIn PDF document text
    • http://baah.ca/images/roblox-vampire-hunters-2-cheats.pdfIn PDF document text
    • http://interpretation-dessins-enfants.net/images/free-roblox-meep-city.pdfIn PDF document text
    • http://nevesomost.by/images/rbxfree-com-free-robux.pdfIn PDF document text
    • http://acktivities.com/images/free-skin-in-roblox-2021.pdfIn PDF document text
    • http://www.occquimica.com.br/images/free-robux-and-limiteds-generator.pdfIn PDF document text
    • http://www.gadanie.lv/images/ways-to-earn-free-robux.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off00037ea2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37EA2 19952 bytes
SHA-256: 22492e318a225390d0f01d3a31701a95e922e704582468a7c69296adfa488a2c
font_01_sfnt_off0003a96a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A96A 18564 bytes
SHA-256: 9f9873079e73cc448288ee38a57df1adb52f76eb4c294246e1b2dedf10dc9055

Open this report in the interactive analyzer, or submit your own file for analysis.