Malicious PDF — malware analysis report

Static analysis result for SHA-256 875f28dd597101a2…

MALICIOUS

PDF

42.5 KB Created: 2021-04-03 17:29:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-05-04
MD5: 293ad34945be873e726f25b2b9eaaa68 SHA-1: 122f303e4022bca00146d06c5e4aeb4f94a280ec SHA-256: 875f28dd597101a224132e54b901093ca456f5af05fdc631aa3950df74f31ece
132 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9175

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-how-to-make-a-shirt-for-free PDF link annotation
    • https://gomsa.nl/images/snippet-roblox-hack.pdf%0AIn PDF document text
    • http://www.htc.edu.au/images/free-roblox-clothescom.pdf%0AIn PDF document text
    • http://zarinnameh.ir/images/hacking-game-roblox.pdf%0AIn PDF document text
    • http://svp-steinmaur.ch/images/roblox-murder-mystery-2-cheat.pdf%0AIn PDF document text
    • http://www.exikom.com.ua/images/free-promo-codes-2021-october-roblox.pdf%0AIn PDF document text
    • http://hemmet-strand.dk/images/how-to-get-free-robux-with-a-fake-creditcard.pdf%0AIn PDF document text
    • http://www.pcclawyers.com.au/images/good-reasons-to-get-free-robux.pdf%0AIn PDF document text
    • http://ff-obertraun.at/images/how-to-get-free-robux-easy-on-chromebook.pdf%0AIn PDF document text
    • http://salantiskis.lt/images/roblox-hack-ios.pdf%0AIn PDF document text
    • https://kimolos-link.gr/images/free-roblox-script-executor.pdf%0AIn PDF document text
    • http://www.hawler.in/images/roblox-hack-script-pastebin.pdf%0AIn PDF document text
    • http://nosocomium.rv.ua/images/how-to-hack-roblox-to-get-robux-on-ipad.pdf%0AIn PDF document text
    • http://echosvoix.ch/images/roblox-cool-kid-hack.pdf%0AIn PDF document text
    • http://www.torvet11.dk/images/roblox-robux-hack-2021-android.pdf%0AIn PDF document text
    • http://kids-academy.pl/images/robux-gift-card-hack.pdf%0AIn PDF document text
    • https://www.u-pin-it.com/images/hack-bee-swarm-simulator-roblox.pdf%0AIn PDF document text
    • https://socialvalue.gr/images/roblox-character-free.pdf%0AIn PDF document text
    • http://www.hawler.in/images/youtube-roblox-hack-elemental-battle-ground.pdf%0AIn PDF document text
    • https://www.foodsafety.cz/images/free-candy-roblox-hack.pdf%0AIn PDF document text
    • https://corbo.ru/images/free-robux-book.pdf%0AIn PDF document text
    • http://www.mjclautrec.fr/images/best-hacks-to-get-free-robux.pdf%0AIn PDF document text
    • https://www.foodsafety.cz/images/btools-hack-roblox-2021.pdf%0AIn PDF document text
    • https://gomsa.nl/images/how-to-hack-in-nba-phenom-roblox.pdf%0AIn PDF document text
    • https://esl.ipb.ac.id/images/roblox-pet-simulator-cheats-mobile.pdf%0AIn PDF document text
    • http://nevesomost.by/images/free-robux-win-2021.pdf%0AIn PDF document text
    • http://www.lionel-seppoloni.fr/images/roblox-cheat-gamepass.pdf%0AIn PDF document text
    • https://www.audev.com/images/how-to-get-free-robux-no-wait-proof.pdf%0AIn PDF document text
    • http://ff-obertraun.at/images/free-robux-hack-generator-club.pdf%0AIn PDF document text
    • http://www.cbgp.upm.es/images/free-cute-outfits-on-royale-high-roblox.pdf%0AIn PDF document text
    • http://www.cbgp.upm.es/images/hacker-roblox-accound.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off000043b8.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000043b8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x43B8 23848 bytes
SHA-256: 568b521343c594e338b12064aecf3fd045a344abefd136786d5e9f9c9beb0d29
font_01_sfnt_off000078dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x78DC 2824 bytes
SHA-256: 94c1b019735d7e491765340abe50b2897410e2ec65ecf141c08bd9f2220897c4
font_02_sfnt_off0000828a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x828A 18328 bytes
SHA-256: c5648366c858e369fbae74bfb87c29f5394b93e00ef312b71ce7743739eacfce

Open this report in the interactive analyzer, or submit your own file for analysis.