PDF static analysis report

Static analysis result for SHA-256 8dfae82e913c28d5…

SUSPICIOUS

PDF

39.6 KB Created: 2026-04-19 10:53:12 +09:00 Authoring application: Aspose Ltd. (via Aspose.PDF for .NET 21.8.0) First seen: 2026-04-23
MD5: 583f0a26da608adad3fc2405e2ae78f5 SHA-1: 085264f0448afd7c0672453f672e1af6cf80bcaf SHA-256: 8dfae82e913c28d5407be4fe3ff4ee582e7adadd07d8e55270cbe97840a9d402
50 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://eooe.gr/images/forsaken-sword-legices-2-roblox-hack.pdf,.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eooe.gr/images/forsaken-sword-legices-2-roblox-hack.pdf In PDF document text
    • https://www.banhngoncaocap.com/images/roblox-jailbreak-free-vip-server-In PDF document text
    • https://gabrieliassociati.com/images/roblox-welcome-to-bloxburg-how-to-get-free-money.pdfIn PDF document text
    • http://uo-nn.ru/images/roblox-lifting-In PDF document text
    • http://meisterhaus-guterl.de/images/free-robux-promo-codes-2021-july.pdfIn PDF document text
    • http://homebackpackers.com/images/how-to-get-In PDF document text
    • http://bodyguardsecurityservices.com.au/images/how-to-get-free-robux-in-your-roblox-account.pdfIn PDF document text
    • http://diatecgroup.com/images/how-hack-in-roblox-with-bad-words.pdfIn PDF document text
    • http://junktiquecollector.com/images/safe-mac-roblox-auto-clicker-In PDF document text
    • http://beagles-of-harmony.de/images/como-tener-robux-gratis-sin-hacks-y-sin-inspeccionar.pdfIn PDF document text
    • http://alarmed.pl/images/roblox-robux-In PDF document text
    • http://lakeshistory.com/images/pastebin-hack-account-roblox.pdfIn PDF document text
    • https://www.arquetopia.org/images/roblox-royal-high-In PDF document text
    • http://bolandergroup.com/images/how-to-hack-roblox-highschool-money.pdfIn PDF document text
    • http://bemviverclin.com.br/images/roblox-how-to-get-any-gamepass-for-free.pdfIn PDF document text
    • http://jointworkstudio.com/images/make-roblox-free-robux.pdfIn PDF document text
    • http://interpretation-dessins-enfants.net/images/how-to-make-a-lvl-7-roblox-exploit-for-free.pdfIn PDF document text
    • https://www.ghknights.org/images/roblox-In PDF document text
    • https://www.tartineartisanal.com/images/como-hackear-uma-conta-no-roblox.pdfIn PDF document text
    • https://d-fankhauser-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00001b0f.bin)

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001b0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B0F 19620 bytes
SHA-256: b287eac988ba15507c1ddf810953d93737a51bc55fba539b323315ca2a13990e
font_01_sfnt_off000041d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41D0 26564 bytes
SHA-256: 7ca1f894672398176317d6e119fea84a7d20dab33f23c7b654d114dedf2f3630

Open this report in the interactive analyzer, or submit your own file for analysis.