Malicious PDF — malware analysis report

Static analysis result for SHA-256 875742961c50edf4…

MALICIOUS

PDF

42.4 KB Created: 2021-04-03 11:10:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-05-04
MD5: 4886c68935465014941e3b8d1a2d4688 SHA-1: 3039f60f974e768a5edad62f59a47d6ededbe214 SHA-256: 875742961c50edf4770be14a897b2ddcaa5f21c95f02b506c1e5ae4e81e56680
132 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9175

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/how-to-get-shirts-on-roblox-for-free PDF link annotation
    • https://www.tsdb.com.au/images/advhaa-roblox-free.pdfIn PDF document text
    • http://www.fanciullovito.it/images/roblox-the-future-cheat-engine.pdfIn PDF document text
    • https://www.brainpads.com/images/how-to-legally-get-free-robux.pdfIn PDF document text
    • http://www.eurologistiki.gr/images/roblox-meep-city-free-items.pdfIn PDF document text
    • http://www.sapaengineering.kz/images/roblox-god-admin-hacks.pdfIn PDF document text
    • https://www.utalii.ac.ke/images/free-roblox-gift-card-code-generator-no-survey.pdfIn PDF document text
    • http://learningarabic.co.uk/images/roblox-free-roam-games-grand-bloxs.pdfIn PDF document text
    • http://www.tamogatoweb.hu/images/how-to-use-inspect-element-to-get-free-robux.pdfIn PDF document text
    • http://www.tamogatoweb.hu/images/roblox-ss-executor-free-v3rmillion.pdfIn PDF document text
    • https://fkg.usu.ac.id/images/best-way-to-hack-roblox.pdfIn PDF document text
    • https://gomsa.nl/images/best-roblox-best-troll-hacks-2021.pdfIn PDF document text
    • http://portal.crfsp.org.br/images/roblox-how-to-change-your-skin-for-free.pdfIn PDF document text
    • http://www.rezbb.sk/images/hack-de-robux-2021.pdfIn PDF document text
    • http://www.gadanie.lv/images/roblox-halloween-costume-free.pdfIn PDF document text
    • https://www.eglihotel.gr/images/how-to-get-free-robux-without-playing-games.pdfIn PDF document text
    • http://www.eurosan1.ba/images/free-roblox-women-hair.pdfIn PDF document text
    • http://learningarabic.co.uk/images/ant-roblox-jailbreak-teleport-hack.pdfIn PDF document text
    • https://www.brainpads.com/images/roblox-free-hack-robux-2021.pdfIn PDF document text
    • http://www.web.stc-part.co.th/images/hacks-for-flora-frenzy-roblox.pdfIn PDF document text
    • https://www.osoc.com/images/roblox-hack-tools-in-the-game-no-mega-android-tutorial.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/roblox-hack-deutsch-pc.pdfIn PDF document text
    • https://www.beaufortcollege.ie/images/roblox-mad-paintball-hack-2021.pdfIn PDF document text
    • http://www.inservis.cl/images/robux-gratis-sin-hacks-2021.pdfIn PDF document text
    • http://energotestcontrol.ru/images/free-tedashii-roblox-id.pdfIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/free-robux-memes.pdfIn PDF document text
    • https://pa-waingapu.go.id/images/how-to-change-your-username-in-roblox-for-free.pdfIn PDF document text
    • http://cosver.eu/images/free-robux-from-apps.pdfIn PDF document text
    • https://sitam.co.in/images/roblox-phantom-forces-hack-mod-menu.pdfIn PDF document text
    • https://gomsa.nl/images/free-roblox-accounts-with-obc-2021.pdfIn PDF document text
    • http://legs11.co.za/images/how-to-change-money-in-roblox-using-cheat-engine.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00004515.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004515.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4515 23164 bytes
SHA-256: 8e7600571b5b08ed2276fc09d517989a4053d42ab3af960e4bc946c10b660587
font_01_sfnt_off00007922.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7922 2820 bytes
SHA-256: 972979c3a46100cf5f8fd289bc6fbd2496ff75fec0e3f6753648c72ec6eba714
font_02_sfnt_off000082c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82C1 18088 bytes
SHA-256: 8a902416a8b85ae2658767c2e117fdc1bc489b224ec0209a27887b47ad6cf0f0

Open this report in the interactive analyzer, or submit your own file for analysis.