MALICIOUS
162
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 User Execution: Malicious File
The PDF document uses social engineering tactics, impersonating Amazon to trick users into downloading a 'Roblox Hack'. Heuristics indicate it's a browser extension installation lure and a password-protected archive lure, suggesting the user is prompted to download and potentially decrypt a malicious payload. The primary malicious URL identified is http://gaminggenerator.org/app/431946152/lawn-mowing-simulator-roblox-hack.
Machine Learning
- Nyx PDF Classifier malicious score 0.7795
Heuristics 6
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISHDocument impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://gaminggenerator.org/app/431946152/lawn-mowing-simulator-roblox-hack.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://gaminggenerator.org/app/431946152/lawn-mowing-simulator-roblox-hack PDF link annotation
- https://www.millatgears.com/images/how-to-get-free-roblox-items.pdfIn PDF document text
- http://axiapublishers.com/images/easy-robux-hack-on-android.pdfIn PDF document text
- https://gaj.rs/images/what-is-the-april-1st-stickmasterluke-hack-face-roblox-called.pdfIn PDF document text
- http://stroygrad-spb.com/images/roblox-how-to-get-a-group-for-free.pdfIn PDF document text
- http://ferienwohnung-walker.de/images/how-to-earn-robux-for-free-2021.pdfIn PDF document text
- https://www.lavigny.ch/images/400-robux-free.pdfIn PDF document text
- http://www.hotelcomelico.it/images/free-robux-codes-2021-august.pdfIn PDF document text
- https://schulzpressetext.de/images/how-to-hack-roblox-deathrun.pdfIn PDF document text
- https://abouttimetech.com/images/again-here-for-free-robux-on-roblox-com-free4mobile24-com.pdfIn PDF document text
- http://medimacs.eu/images/robux-free-codes-2021.pdfIn PDF document text
- https://amatq.ca/images/sign-up-for-free-robux.pdfIn PDF document text
- https://www.tsdb.com.au/images/roblox-free-account-biz.pdfIn PDF document text
- http://fotoflas.gr/images/i-love-cats-shirt-roblox-free.pdfIn PDF document text
- http://www.copoint.co.uk/images/free-items-catalog-roblox.pdfIn PDF document text
- http://bufbd.org/images/accessory-hat-ashs-hat-on-roblox-free.pdfIn PDF document text
- https://beejekorf.nl/images/cheats-to-get-money-on-roblox-woodson.pdfIn PDF document text
- http://www.guidaturisticaverona.it/images/b-tool-hack-in-roblox-link.pdfIn PDF document text
- http://news123.it/images/free-roblox-steamy-xxx-videos-lol.pdfIn PDF document text
- https://verdensbarn.no/images/free-no-verification-robux-generator.pdfIn PDF document text
- https://verdensbarn.no/images/pastebin-unlimited-free-robux-and-obc-on-roblox-2021.pdfIn PDF document text
- https://sitam.co.in/images/roblox-robux-generator-2021-free-download-no-surveys.pdfIn PDF document text
- https://www.colditex.com/images/how-to-get-free-money-in-roblox-jailbreak-2021.pdfIn PDF document text
- https://bancroftandsons.com/images/roblox-hack-after-update-1608.pdfIn PDF document text
- http://domaizdereva24.ru/images/free-download-roblox-for-android-phone.pdfIn PDF document text
- https://www.cpnf.ch/images/how-get-free-roblox.pdfIn PDF document text
- https://verdensbarn.no/images/how-to-hack-dragon-ball-rage-roblox-2021.pdfIn PDF document text
- http://behsanroshd.com/images/free-robux-hack-2021-lenovo.pdfIn PDF document text
- http://dialine.cz/images/free-roblox-studio-library.pdfIn PDF document text
- http://evp-sanorlenok.ru/images/how-to-get-free-faces-on-roblox.pdfIn PDF document text
- http://www.hawler.in/images/roblox-new-shoot-through-walls-hack.pdfIn PDF document text
- http://uctovnictvosnv.sk/images/roblox-hacks-download-mac.pdfIn PDF document text
- http://panaceafamilymedicine.com/images/roblox-hat-free-2021.pdfIn PDF document text
- https://studentcareerinfo.com/images/lifting-simulator-roblox-new-hack.pdfIn PDF document text
- http://addair.co.uk/images/how-to-get-free-turbo-builders-club-on-roblox.pdfIn PDF document text
- http://kim-kinder-im-mittelpunkt.de/images/how-to-hack-anything-in-roblox.pdfIn PDF document text
- http://rumler.pl/images/stella-roblox-hack-buy.pdfIn PDF document text
- http://www.sapaengineering.kz/images/how-to-hack-roblox-copy-any-roblox-game.pdfIn PDF document text
- http://ivalor.fr/images/guuudinfo-robux-hack-no-persinal-infomation.pdfIn PDF document text
- http://auto-mankel.de/images/free-balloon-pauldrons-on-roblox.pdfIn PDF document text
- http://news123.it/images/free-roblox-stuff-catalog.pdfIn PDF document text
- https://www.hotschool.com.au/images/what-is-the-robux-hex-value-in-cheat-engine.pdfIn PDF document text
- https://www.stkdb.cz/images/telecharger-roblox-hack-apk.pdfIn PDF document text
- https://www.abrapppe.org.br/images/free-robux-2021-no-survey.pdfIn PDF document text
- https://www.cpnf.ch/images/play-roblox-for-free-online-now.pdfIn PDF document text
- https://www.albisser.ch/images/how-to-get-a-free-dominus-roblox.pdfIn PDF document text
- https://pemadamapi.net/images/free-robux-download-no-virus.pdfIn PDF document text
- http://brandyourbody.com/images/roblox-hack-mobile-generator.pdfIn PDF document text
- http://texnes-plus.gr/images/cheat-codes-for-free-stuff-roblox.pdfIn PDF document text
- http://africadaily.co.za/images/free-robux-by-doing-nothing.pdfIn PDF document text
+14 more URL(s)
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off000081fd.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x81FD | 25700 bytes |
SHA-256: 2f20ab1d3bd33bd0d86ddfbd5c4be03a770f3299e0c6edb9240503c44c44dfba |
|||
font_01_sfnt_off0000bd1b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBD1B | 18860 bytes |
SHA-256: 8ec49de649022794bf49f484ad95d3cd623cfe680d65ac3952c18e61842626a6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.