MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document contains a large number of URLs pointing to websites offering game hacks and exploits, specifically for Roblox. The heuristic firings indicate a 'game hack SEO link farm' and a malformed exploit stream, suggesting the document is designed to redirect users to malicious sites. While no scripts were extracted, the document body and heuristics strongly suggest a phishing or scam attempt to lure users into downloading potentially harmful files.
Machine Learning
- Nyx PDF Classifier malicious score 0.9723
Heuristics 6
-
PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARMPDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
-
Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTHA PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
-
PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARMPDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/descargar-hacks-para-roblox-2021-con-fly PDF link annotation
- http://www.eurosan1.ba/images/hacker-roblox-portable.pdf%0AIn PDF document text
- http://www.copoint.co.uk/images/roblox-injectors-free.pdf%0AIn PDF document text
- http://www.hawler.in/images/hack-for-all-games-roblox.pdf%0AIn PDF document text
- https://www.lomrad.go.th/images/roblox-avatar-customize-free.pdf%0AIn PDF document text
- https://verdensbarn.no/images/how-to-bypass-cheat-engine-on-roblox-2021.pdf%0AIn PDF document text
- https://www.air-shop.cz/images/beyond-roblox-hack-scriptr.pdf%0AIn PDF document text
- http://www.gadanie.lv/images/free-bc-robux.pdf%0AIn PDF document text
- https://www.lavigny.ch/images/free-robux-site-no-survey.pdf%0AIn PDF document text
- https://www.seeingindependence.org/images/how-to-get-a-free-car-in-bloxburg-roblox.pdf%0AIn PDF document text
- http://www.ntc.edu.za/images/roblox-mad-paintball-2-hacks.pdf%0AIn PDF document text
- http://ff-obertraun.at/images/hack-arsenal-roblox-2021.pdf%0AIn PDF document text
- https://meltonschool.org/images/wwwfree-robuxcom-free-robux-now.pdf%0AIn PDF document text
- https://www.wildpark-johannismuehle.de/images/how-do-you-change-your-name-on-roblox-for-free.pdf%0AIn PDF document text
- http://pa-tanjungselor.go.id/images/como-obtener-robux-hack.pdf%0AIn PDF document text
- http://www.mikramarine.gr/images/hack-roblox-cs-go.pdf%0AIn PDF document text
- http://www.inservis.cl/images/how-to-hack-int-a-friends-roblox-account.pdf%0AIn PDF document text
- https://www.stkdb.cz/images/roblox-x-ray-hack.pdf%0AIn PDF document text
- https://www.iadh.bi/images/code-for-roblox-hack-generator.pdf%0AIn PDF document text
- http://www.ntc.edu.za/images/royalty-free-roblox-music.pdf%0AIn PDF document text
- https://verdensbarn.no/images/get-roblox-app-for-free.pdf%0AIn PDF document text
- https://www.lavigny.ch/images/hack-script-roblox-game.pdf%0AIn PDF document text
- http://energotestcontrol.ru/images/free-robux-generator-august-2021.pdf%0AIn PDF document text
- http://gops.pruszczgdanski.pl/images/free-catalog-items-roblox-2021-december.pdf%0AIn PDF document text
- http://salantiskis.lt/images/cheat-for-roblox-super-speed-and-jump-hack.pdf%0AIn PDF document text
- https://www.wildpark-johannismuehle.de/images/hack-de-counter-blox-roblox-offensive.pdf%0AIn PDF document text
- http://hemmet-strand.dk/images/free-safe-roblox-exploits.pdf%0AIn PDF document text
- http://www.evaplast.by/images/win-2021-free-robux.pdf%0AIn PDF document text
- http://salantiskis.lt/images/robux-redeem-card-hack.pdf%0AIn PDF document text
- http://www.jureclomas.com.ar/images/roblox-alt-accounts-free.pdf%0AIn PDF document text
- http://aeroclub-kaernten.at/images/how-to-get-free-robux-2021-january.pdf%0AIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off000033ae.bin)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000033ae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x33AE | 19616 bytes |
SHA-256: 3c9c03c30fd06ad7a5edfe47a9f38956339579b7a820805ed91e8c8266d10687 |
|||
font_01_sfnt_off00005d42.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5D42 | 19264 bytes |
SHA-256: 7b5c4986a573f534c5527aebe282a2ad907937bac052ea278136b1b57da7f966 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.