MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of embedded URLs, identified by the PDF_GAME_HACK_SEO_LINK_FARM heuristic, that lead to websites promising game hacks and free virtual currency. These URLs are likely part of a scam to generate ad revenue or phish users. While no scripts were explicitly extracted, the nature of the content and the ML classifier output strongly suggest malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9735
Heuristics 5
-
PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARMPDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
-
PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARMPDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/game-roblox-free-online PDF link annotation
- https://gomsa.nl/images/farm-life-roblox-cheat.pdf%0AIn PDF document text
- https://estalagemmonteverde.com.br/images/roblox-redline-hack.pdf%0AIn PDF document text
- https://www.audev.com/images/google-how-do-you-get-free-robux.pdf%0AIn PDF document text
- http://svp-steinmaur.ch/images/roblox-bot-free.pdf%0AIn PDF document text
- https://technospektr.com.ua/images/how-to-get-free-robux-free-codes.pdf%0AIn PDF document text
- https://corbo.ru/images/roblox-hack-me-free-robux.pdf%0AIn PDF document text
- http://www.lionel-seppoloni.fr/images/how-to-get-free-headphones-on-roblox-2021.pdf%0AIn PDF document text
- https://www.porthos.it/images/chicago-2021-free-model-roblox.pdf%0AIn PDF document text
- https://www.wildpark-johannismuehle.de/images/how-do-you-get-free-cars-in-roblox-vehicle-simulatert.pdf%0AIn PDF document text
- https://consorziocsa-asicaivano.it/images/was-roblox-hacked-once.pdf%0AIn PDF document text
- https://www.utalii.ac.ke/images/how-to-get-5-robux-for-free-2021.pdf%0AIn PDF document text
- http://uptodate.az/images/how-to-use-nexus-to-hack-in-roblox-royale-high.pdf%0AIn PDF document text
- https://www.porthos.it/images/free-robux-for-samsung.pdf%0AIn PDF document text
- https://www.tsdb.com.au/images/rbx-free-roblox.pdf%0AIn PDF document text
- http://www.remiauclair.fr/images/robloxgamehackonline-verification-problem.pdf%0AIn PDF document text
- http://kids-academy.pl/images/free-hair-roblox-not-model-or-decal.pdf%0AIn PDF document text
- http://www.nielsen2u.dk/images/how-to-get-free-robux-on-a-laptop-2021.pdf%0AIn PDF document text
- http://www.drent.se/images/exos-cheat-roblox.pdf%0AIn PDF document text
- http://escolaarboc.cat/images/roblox-robux-hack-generato.pdf%0AIn PDF document text
- http://salantiskis.lt/images/roblox-hack-get-unlimited-robux-november-2021.pdf%0AIn PDF document text
- http://hemmet-strand.dk/images/win-free-robux-robux-robux-free-new-game-order-roblox.pdf%0AIn PDF document text
- https://www.eglihotel.gr/images/free-knife-cbro-roblox.pdf%0AIn PDF document text
- http://www.agri-tech.com.au/images/roblox-4all-cool-roblox-hack.pdf%0AIn PDF document text
- http://chartsmart.com.au/images/how-to-get-free-robux-without-having-to-download-anything.pdf%0AIn PDF document text
- http://aeroclub-kaernten.at/images/comment-hacker-roblox-sans-logiciel-youtube.pdf%0AIn PDF document text
- https://www.eglihotel.gr/images/roblox-cheats-2021-robux.pdf%0AIn PDF document text
- https://www.beaufortcollege.ie/images/free-robux-2021-april.pdf%0AIn PDF document text
- http://www.exikom.com.ua/images/how-to-get-free-robux-working-2021-phone-easy.pdf%0AIn PDF document text
- http://escolaarboc.cat/images/free-robux-without-survey.pdf%0AIn PDF document text
- http://iluvlocalplaces.com/images/hack-roblox-apocalypse-rising-2021.pdf%0AIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off000033a7.bin)
🗂 Part of campaign:
escolaarboc.cat
3 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000033a7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x33A7 | 18988 bytes |
SHA-256: 66027bb0252177770cd88b4ac24d0ee9052d8562a8316496d119b741c3874625 |
|||
font_01_sfnt_off00005b35.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5B35 | 17952 bytes |
SHA-256: 32f21602adfb30dcabb52a49ce17e7cb3a363a08c6708650776294f64dbd81bc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.