PDF malware analysis — malicious · ea0a7e1d45e1004f

MALICIOUS

PDF

246.0 KB Created: 2021-04-05 02:09:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 03d1682463a22a978feba1348acc4e24 SHA-1: a4093cf9e33499792e5cc657be9285814099b561 SHA-256: ea0a7e1d45e1004ff7a2f4ff57b374edc3694852ca89c012ee40f2b680f8d04e

72 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Pdf.Phishing.Roblox062100-9873116-0, indicating a phishing attempt related to Roblox. The document body, though heavily obfuscated, contains references to 'wall hacks on Roblox' and the embedded URL points to a similar topic. This suggests the document is designed to trick users into visiting a malicious site, likely for credential harvesting or malware distribution.

Machine Learning

Nyx PDF Classifier suspicious score 0.2693

Heuristics 4

ClamAV: Pdf.Phishing.Roblox062100-9873116-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Roblox062100-9873116-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://gaminggenerator.org/app/431946152/how-to-get-wall-hacks-on-roblox PDF link annotation
- https://semanasantacehegin.com/images/free-toys-codes-roblox-2021.pdfIn PDF document text
- http://batutynas.lt/images/how-to-get-clothes-for-free-on-roblox-2021.pdfIn PDF document text
- http://www.hotelcimone.it/images/free-robux-promotion.pdfIn PDF document text
- http://www.bripi.pl/images/roblox-hack-more-13.pdfIn PDF document text
- http://armatrutz.de/images/free-roblox-injector-and-script-executor-2021.pdfIn PDF document text
- http://steklofara.com.ua/images/how-to-cheat-on-dragon-ball-rage-roblox.pdfIn PDF document text
- http://autenticohostalsalou.com/images/hackear-roblox-juegos.pdfIn PDF document text
- http://tehergumi.hu/images/how-to-get-free-robux-in-ios.pdfIn PDF document text
- http://energotestcontrol.ru/images/hacks-de-pago-para-roblox.pdfIn PDF document text
- https://www.manmed.info:443/images/roblox-free-coloring-pages.pdfIn PDF document text
- http://www.awakeningtruth.org/images/how-to-get-roblox-premium-for-free.pdfIn PDF document text
- http://wattkit.com/images/arcane-adventures-roblox-free.pdfIn PDF document text
- https://www.stoehr-sauer.de/images/comment-devenir-hacker-sur-roblox.pdfIn PDF document text
- https://zszolesno.pl/images/how-too-hack-in-murder-mystery-2-roblox-2021.pdfIn PDF document text
- https://www.alu-as.cz/images/roblox-kick-hack-fe.pdfIn PDF document text
- http://apcupschennai.com/images/roblox-hack-ninja-legends.pdfIn PDF document text
- http://techmobil.pl/images/how-to-get-free-robux-no-joke-2021.pdfIn PDF document text
- https://www.tsdb.com.au/images/skater-hacks-roblox.pdfIn PDF document text
- http://africadaily.co.za/images/roblox-supreme-free.pdfIn PDF document text
- https://xn--80adfcepoood1a3b.xn--p1ai/images/roblox-majora-free.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00037cb8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x37CB8	23416 bytes
SHA-256: `0c20b2a03fae44ad2fad46e400796d348c143b4a13d96d4f93640a326c6b070b`
`font_01_sfnt_off0003b172.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3B172	18220 bytes
SHA-256: `76e703e4be4cc56af50890b3cf65d3241b2e60a82d0ee8378d24961757cd4df1`

Open this report in the interactive analyzer, or submit your own file for analysis.