MALICIOUS
82
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF document contains numerous URLs pointing to sites offering game hacks and free Robux, indicating a lure for users to download malicious content. The heuristic firings, including ML_NYX_PDF_MALICIOUS and SE_SECURITY_BYPASS, strongly suggest malicious intent. The document body and embedded URLs suggest the primary goal is to trick users into downloading a second-stage payload, likely disguised as a game hack or exploit.
Machine Learning
- Nyx PDF Classifier malicious score 0.9977
Heuristics 4
-
Security software disable instruction high SE_SECURITY_BYPASSDocument instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gaminggenerator.org/app/431946152/hack-robux-youtube-game-hack
- http://reclaimcottage.co.uk/images/how-to-hack-roblox-usesing-python.pdf
- http://ferienhaus-summt.de/images/donwload-roblox-free-on-chrome.pdf
- http://jenne-technik.de/images/roblox-one-piece-millenium-stats-hack-script.pdf
- http://arhi-z.ru/images/vechil-simulator-money-hack-roblox.pdf
- http://keepcasscountybeautiful.com/images/www-robux-hacker-co.pdf
- http://stomatolog-choszczno.pl/images/roblox-jailbreak-hack-script-pastebin.pdf
- http://www.hhls.com.au/images/how-to-get-free-admin-on-roblox-pastebin.pdf
- http://fiur-malermeister.de/images/earn-robux-today-free.pdf
- http://fwv-vallendar.de/images/free-roblox-promotion-codes.pdf
- http://ines.co.rs/images/the-easiest-way-to-get-free-robux.pdf
- https://ceiprevellodetoro.org/images/free-roblox-robux-generator-2021.pdf
- http://pechativmoskve.ru/images/roblox-vehicle-simulator-money-hack-deutsch-2021.pdf
- http://www.actae.gr/images/roblox-cheat-engine-robux-hack-2021.pdf
- http://mnp-realty.ru/images/roblox-free-no-login.pdf
- https://masseymotorcars.com/images/free-vector-roblox-logo.pdf
- http://www.bzconstructionservices.com/images/free-roblox-generator.pdf
- http://sfsbm.org/images/hack-roblox-btools-2021.pdf
- http://jasperfirstumc.com/images/roblox-speed-hacks-that-u-can-type-in-chat.pdf
- http://inextpresident.com/images/easy-way-to-get-free-robux.pdf
- http://apx-centre.ru/images/roblox-free-ninja-mask.pdf
- http://ferienhaus-summt.de/images/donwload-roblox-free-on-
- http://arhi-z.ru/images/vechil-simulator-money-hack-
- http://stomatolog-choszczno.pl/images/roblox-jailbreak-hack-
- http://fiur-malermeister.de/images/earn-
- http://ines.co.rs/images/the-easiest-way-to-get-free-
- http://pechativmoskve.ru/images/roblox-vehicle-simulator-
- http://mnp-realty.ru/images/roblox-free-
- http://www.bzconstructionservices.com/images/free-roblox-
- http://jasperfirstumc.com/images/roblox-speed-hacks-that-u-can-type-in-
- http://en.wikipedia.org/wiki/MIT_License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00005c1f.binbd8079e302388af4f7a8b7b8cd6248dd86acfa83238df5cf8f4f5d8045822443 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x5C1F | 25152 bytes |
font_01_sfnt_off000095bd.bin7ec66b99b84e32fa2edd048725db551aa3ab6ab24d740b9071aff48b885c73e9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x95BD | 17728 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.