MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of links to websites promising game hacks and virtual currency, indicative of a scam or phishing operation. The heuristic 'PDF_GAME_HACK_SEO_LINK_FARM' strongly suggests this malicious intent. While no scripts were extracted, the document body and heuristics point to a spearphishing attachment used to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.8097
Heuristics 5
-
PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARMPDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
-
PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARMPDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/mad-factor-mad-city-hack-roblox PDF link annotation
- http://www.torvet11.dk/images/free-robux-script-2021.pdf%0AIn PDF document text
- https://www.albisser.ch/images/hacker-shirt-roblox.pdf%0AIn PDF document text
- https://www.air-shop.cz/images/free-robux-gift-card-20210-robux-codes-2021.pdf%0AIn PDF document text
- https://www.milewood.co.uk/images/hacked-jailbreak-roblox-with-no-verification.pdf%0AIn PDF document text
- http://escolaarboc.cat/images/free-robux-no-human-verification-or-survey-2021-easy.pdf%0AIn PDF document text
- http://www.adravietnam.org/images/descendants-2-games-on-roblox-free.pdf%0AIn PDF document text
- http://www.zdravazena.sk/images/apocalypse-rising-roblox-hacker-gives-best-loot.pdf%0AIn PDF document text
- http://www.fluidtech.hu/images/free-robux-100-working-2021.pdf%0AIn PDF document text
- http://www.gadanie.lv/images/hack-roblox-net-one-handynummer.pdf%0AIn PDF document text
- https://www.iadh.bi/images/roblox-rainbow-wings-free.pdf%0AIn PDF document text
- http://bkd1.balikpapan.go.id/images/counter-blox-roblox-offensive-hack-free.pdf%0AIn PDF document text
- http://www.boic.nl/images/free-robux-now-no-survey.pdf%0AIn PDF document text
- http://echosvoix.ch/images/free-roblox-redeem-card-codes-2021.pdf%0AIn PDF document text
- https://www.sitiwebjoomla.it/images/goo-gl-wx0ofq-free-robux.pdf%0AIn PDF document text
- http://www.lovecraftiana.com.ar/images/free-roblox-accounts-with-lifetime-obc.pdf%0AIn PDF document text
- http://escolaarboc.cat/images/roblox-studio-free-scripts.pdf%0AIn PDF document text
- https://kimolos-link.gr/images/how-to-get-free-robux-ipad-only-2021-youtube.pdf%0AIn PDF document text
- https://gomsa.nl/images/hack-para-roblox-dragon-ball-rage.pdf%0AIn PDF document text
- http://svp-steinmaur.ch/images/free-bugatti-roblox.pdf%0AIn PDF document text
- http://www.zdravazena.sk/images/how-to-get-free-202100-robux.pdf%0AIn PDF document text
- http://www.boic.nl/images/how-to-cheat-in-roblox-basewars.pdf%0AIn PDF document text
- http://nevesomost.by/images/roblox-ninja-simulator-2-cheat-engine.pdf%0AIn PDF document text
- http://escolaarboc.cat/images/free-robux-and-tix-generator-online.pdf%0AIn PDF document text
- https://www.stkdb.cz/images/roblox-saob-hack.pdf%0AIn PDF document text
- http://nosocomium.rv.ua/images/free-tix-and-robux-site.pdf%0AIn PDF document text
- http://www.anies.eu/images/how-to-set-up-pf-pros-roblox-cheats.pdf%0AIn PDF document text
- https://accord.kiev.ua/images/how-to-get-the-lamborghini-in-roblox-jailbreak-free.pdf%0AIn PDF document text
- https://gomsa.nl/images/free-card-codes-roblox-2021.pdf%0AIn PDF document text
- https://www.tsdb.com.au/images/how-do-you-send-a-roblox-fottage-of-someone-hacking.pdf%0AIn PDF document text
- http://learningarabic.co.uk/images/book-wings-roblox-free.pdf%0AIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off00004467.bin)
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off00004467.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x4467 | 23776 bytes |
SHA-256: 5e78179e76c3a84430ca9316fdf20797c527d8842b97b7dd409f3bf42e49551c |
|||
font_01_sfnt_off00007a97.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7A97 | 2836 bytes |
SHA-256: fd98c8f6e7c2e74bbd5822409159a93ac5c94da083ae4c2eb269d4284375f9e8 |
|||
font_02_sfnt_off00008437.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8437 | 6656 bytes |
SHA-256: c2ccef7015da6354a8bfba3146ab010941775f8e70b319db6f709a5007915dd4 |
|||
font_03_sfnt_off000093dd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x93DD | 18364 bytes |
SHA-256: a56c5b65ab31700444980d79cc4bd384659475efc8bc81f70d7bc62c0a96d0fc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.