MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of links related to 'game hacks' and 'free items' for Roblox, indicating a scam or phishing attempt. The heuristic firings confirm the presence of a link farm designed to lure users to potentially malicious websites. No scripts were extracted, but the document's structure and content strongly suggest a social engineering attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9725
Heuristics 5
-
PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARMPDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
-
PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARMPDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/free-clothes-for-roblox-avatar PDF link annotation
- http://aeroclub-kaernten.at/images/free-roblox-car.pdf%0AIn PDF document text
- http://www.jureclomas.com.ar/images/free-roblox-codes-from-the-toys.pdf%0AIn PDF document text
- http://www.mikramarine.gr/images/best-roblox-hacked-clients-2021-youtube.pdf%0AIn PDF document text
- http://www.cosver.nl/images/awesome-free-stuff-on-roblox.pdf%0AIn PDF document text
- http://ff-obertraun.at/images/how-to-make-a-free-robux-scam.pdf%0AIn PDF document text
- http://www.drent.se/images/roblox-avatar-customizer-free.pdf%0AIn PDF document text
- http://www.vktzunami.cz/images/roblox-jailbreak-hack-autorob.pdf%0AIn PDF document text
- http://fa-deco.com/images/roblox-hack-2021-online-free-robux.pdf%0AIn PDF document text
- https://estalagemmonteverde.com.br/images/free-robux-ashar-qaseem.pdf%0AIn PDF document text
- https://bancroftandsons.com/images/how-to-hack-roblox-and-get-robux-on-first-attempt.pdf%0AIn PDF document text
- http://bilhetim.com.br/images/free-robux-hack-generator-2021.pdf%0AIn PDF document text
- http://www.copoint.co.uk/images/hacks-roblox-scripts.pdf%0AIn PDF document text
- https://corbo.ru/images/free-cool-roblox-clothes.pdf%0AIn PDF document text
- http://www.boic.nl/images/8-free-robux.pdf%0AIn PDF document text
- http://armatrutz.de/images/lost-hack-roblox.pdf%0AIn PDF document text
- https://www.eglihotel.gr/images/roblox-scp-hack.pdf%0AIn PDF document text
- http://uctovnictvosnv.sk/images/roblox-lumber-tycoon-2-hack-script-2021.pdf%0AIn PDF document text
- https://esl.ipb.ac.id/images/tofu-costume-roblox-for-free.pdf%0AIn PDF document text
- http://www.sapaengineering.kz/images/roblox-guthaben-hacken.pdf%0AIn PDF document text
- https://gastroration.ru/images/how-to-download-nonsense-diamond-hack-roblox.pdf%0AIn PDF document text
- https://www.hotschool.com.au/images/mod-menu-roblox-no-crashing-free.pdf%0AIn PDF document text
- http://ims-77.fr/images/cheating-on-my-roblox-gf.pdf%0AIn PDF document text
- http://www.hawler.in/images/how-to-get-hack-to-hack-people-on-roblox.pdf%0AIn PDF document text
- https://www.fhccu.com/images/roblox-hack-attack.pdf%0AIn PDF document text
- http://salantiskis.lt/images/robloxs-got-talent-piano-hack.pdf%0AIn PDF document text
- http://www.sanjosedeminas.gob.ec/images/hack-robux-script.pdf%0AIn PDF document text
- http://www.lycee-langevin-wallon.com/images/free-roblox-username-and-password-login.pdf%0AIn PDF document text
- http://www.nielsen2u.dk/images/how-to-hack-in-attrition-roblox.pdf%0AIn PDF document text
- https://www.cpnf.ch/images/how-to-get-free-robux-mobile-root-needed.pdf%0AIn PDF document text
- http://bkd1.balikpapan.go.id/images/how-do-yoy-get-robux-for-free.pdf%0AIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00003346.bin)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003346.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3346 | 18928 bytes |
SHA-256: c4106172713c87708d5b6111b4e463cb7cc7d90773eeec846c1eac4aaf56b61b |
|||
font_01_sfnt_off00005adb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5ADB | 17984 bytes |
SHA-256: 44ffe1daddb6540a9ba0609e0e1067bf8dfd87b11669e3122ca0a5b9b015cbcd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.