PDF static analysis report

Static analysis result for SHA-256 ff956b8f7060cc7d…

SUSPICIOUS

PDF

40.7 KB Created: 2021-04-03 17:14:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 65d367a283368a0a387630fa5e467a24 SHA-1: d72ab8056f6c8d5d17303995e2fe535d450d2331 SHA-256: ff956b8f7060cc7d4ef7947a1c5fe0c0ae6c9eed1f025c4da04e724ac85e169d
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded URLs and a prominent external URI pointing to sites offering 'Roblox hack scripts'. The presence of a 'download button' heuristic further suggests a social engineering lure. The ML classifier also flagged this PDF as malicious, indicating a high probability of malicious intent. No scripts were extracted, but the document's structure and embedded links strongly indicate it's designed to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/roblox-mm2-hack-script-2021 PDF link annotation
    • https://www.foodsafety.cz/images/youtube-free-robux-2021-bluebig.pdf%0AIn PDF document text
    • http://www.gadanie.lv/images/roblox-hack-tool-download-2021-pc.pdf%0AIn PDF document text
    • http://www.anies.eu/images/how-to-get-free-robux-without-doing-a-human-verification.pdf%0AIn PDF document text
    • https://www.stkdb.cz/images/hacks-for-flora-frenzy-roblox.pdf%0AIn PDF document text
    • http://energotestcontrol.ru/images/roblox-hack-script-give-weapons.pdf%0AIn PDF document text
    • http://cosver.eu/images/robux-hack-working-2021.pdf%0AIn PDF document text
    • http://baah.ca/images/how-to-get-free-robux-2021-quad.pdf%0AIn PDF document text
    • http://svp-steinmaur.ch/images/roblox-swear-hack.pdf%0AIn PDF document text
    • http://pa-tanjungselor.go.id/images/roblox-robux-hack-1-easy-step.pdf%0AIn PDF document text
    • https://www.fhccu.com/images/roblox-royale-high-school-hacks-de-to-get-diamonds.pdf%0AIn PDF document text
    • http://pa-tanjungselor.go.id/images/roblox-free-auf-poki.pdf%0AIn PDF document text
    • http://gops.pruszczgdanski.pl/images/roblox-free-game-no-need-to-install.pdf%0AIn PDF document text
    • http://www.torvet11.dk/images/how-to-hack-any-items-free-roblox.pdf%0AIn PDF document text
    • http://www.actae.gr/images/free-robux-does-not-work.pdf%0AIn PDF document text
    • https://tokunfome.com.br/images/roblox-veil-hack-update.pdf%0AIn PDF document text
    • https://www.dierenartsberghman.be/images/free-robux-no-offers-no-survey.pdf%0AIn PDF document text
    • http://www.pcclawyers.com.au/images/whats-a-code-for-roblox-to-get-free-robux.pdf%0AIn PDF document text
    • http://echosvoix.ch/images/www-mistplay-com-how-to-get-free-robux.pdf%0AIn PDF document text
    • http://uctovnictvosnv.sk/images/www-hack-clients-robloxde.pdf%0AIn PDF document text
    • https://www.lavigny.ch/images/free-202120212021202120212021202120212021202120212021-robux.pdf%0AIn PDF document text
    • https://www.seeingindependence.org/images/hacks-para-tener-robux-gratis-2021.pdf%0AIn PDF document text
    • https://www.air-shop.cz/images/roblox-games-fan-free.pdf%0AIn PDF document text
    • https://www.tsdb.com.au/images/roblox-hack-scropts.pdf%0AIn PDF document text
    • https://socialvalue.gr/images/how-to-hack-peoples-account-on-roblox.pdf%0AIn PDF document text
    • https://estalagemmonteverde.com.br/images/crear-cuenta-hack-en-roblox.pdf%0AIn PDF document text
    • http://www.web.stc-part.co.th/images/robux-hack-no-games.pdf%0AIn PDF document text
    • http://www.eurologistiki.gr/images/le-jeux-du-hack-roblox.pdf%0AIn PDF document text
    • https://www.cpnf.ch/images/how-to-get-free-robux-2021-easy.pdf%0AIn PDF document text
    • https://www.sitiwebjoomla.it/images/roblox-group-free-robux.pdf%0AIn PDF document text
    • https://www.hbproducts.dk/images/free-robux-glitch-ios.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000044e8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x44E8 23572 bytes
SHA-256: 0a3f64ae6ce8cfd09084706c8a0d302cbcfff69ec925a1b3dd4d28b564f5723a
font_01_sfnt_off00007a7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A7A 18684 bytes
SHA-256: 02e28caf2ab5734422539f07e1013cb2d71bc3f3a0ad6f6ec00f491f89ac88dd

Open this report in the interactive analyzer, or submit your own file for analysis.