THE BEST ROBUX GENERATOR EVER

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T426,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample a2cdf98e739f… — Score 74/100 — Hybrid Analysis","description":"Malicious verdict for sample a2cdf98e739f…. Threat score 74/100. 0/28 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1"],"about":{"@type":"SoftwareApplication","name":"IBM-free-robux-generator-super.pdf","applicationCategory":["pdf"],"identifier":"a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1","additionalType":"Malicious sample"},"threatScore":74,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te46,Object ID 5 contains compressed stream data: No filters Object ID 7 contains compressed stream data: No filters Object ID 11 contains compressed stream data: No filters Object ID 15 contains compressed stream data: No filters Object ID 18 contains compressed stream data: No filters Object ID 21 contains compressed stream data: No filters Object ID 24 contains compressed stream data: No filters Object ID 33 contains compressed stream data: No filters Object ID 35 contains compressed stream data: No filters Object ID 38 contains compressed stream data: No filters Object ID 42 contains compressed stream data: /CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 45 contains compressed stream data: /CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 48 contains compressed stream data: /CIDInit/ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo<< /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName/Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange 2 ... Object ID 51 contains compressed stream data: /CIDInit/ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo<< /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName/Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange 1 ... Object ID 54 contains compressed stream data: /CIDInit/ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo<< /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName/Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange 3 ... Object ID 58 contains compressed stream data: /CIDInit/ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo<< /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName/Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <00> <FF> endcodespacerange 6 ... Object ID 64 contains compressed stream data: true\x00?\x00\x80\x00\x03\x00@cmapU=OH\x00\x00\x00\xcc\x00\x00\x01\x12cvt m\xaa\xbd0\x00\x00\x01\xe0\x00\x00\x07`fpgm\x16\x17'K\x00\x00@\x00\x00\x06>glyfT\xb0\xa8\xbf\x00\x00\x0f\x80\x00\x00\x19\x0ehead\xf9b\xe0\x0f\x00\x00(\x90\x00\x00\x006hheag\xfe\x ... Object ID 66 contains compressed stream data: true\x00?\x00\x80\x00\x03\x00@cmap"\x19\x16\x12\x00\x00\x00\xcc\x00\x00\x01\x12cvt \x1b\x87\x8c=\x00\x00\x01\xe0\x00\x00\x03\x14fpgm\xd9\xe2a}\x00\x00\x04\xf4\x00\x00\x06\xf6glyf\x02\xedf\x83\x00\x00?\xec\x00\x00\x08\xd2head\xa5\xe8\xa0\x13\x00\x00\x14\xc0 ... Object ID 68 contains compressed stream data: true\x00?\x00\x80\x00\x03\x00@cmap\xd1\xb5\xac\xc8\x00\x00\x00\xcc\x00\x00\x01\x12cvt \xc4\xee\xdb\x8c\x00\x00\x01\xe0\x00\x00\x08 fpgm}x\xa3\xcb\x00\x00 ?\x00\x00\x06?glyf\xca\x94E\x86\x00\x00\x10L\x00\x00<\xf0head\xcd[\xe0\x0f\x00\x00M<\x00\x00\x00 ... Object ID 70 contains compressed stream data: true\x00?\x00\x80\x00\x03\x00@cmapF#\x13\x00\x00\x00\x00\xcc\x00\x00\x01\x12cvt ]\xe2$\x1e\x00\x00\x01\xe0\x00\x00\x07\xe0fpgm\x93\xaa?\x02\x00\x00\xc0\x00\x00\x06jglyf\xf1\xf6U@\x00\x00\x10 \x00\x00\x92XheadOC\xf5\x0f\x00\x00\xa2\x84\x00\x00\x006hhea\x88 ...28:T6fd,Pattern match: "https://free-robux-generator-roblox.blogspot.com/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "https://giftcardcode.pro/robux" Pattern match: "https://free-robux-generator-roblox.blogspot.com/favicon.ico" Pattern match: "https://free-robux-generator-roblox.blogspot.com/feeds/posts/default" Pattern match: "https://free-robux-generator-roblox.blogspot.com/feeds/posts/default?alt=rss" Pattern match: "https://www.blogger.com/feeds/7318622767188199316/posts/default" Pattern match: "https://www.blogger.com/profile/02019010055242595617" Pattern match: "fonts.gstatic.com/s/damion/v9/hv-XlzJ3KEUe_YZkamw2.woff2" Pattern match: "git.io/normalize" Pattern match: "https://www.blogblog.com/indie/mspin_black_large.svg" Pattern match: "https://www.blogblog.com/indie/mspin_white_large.svg" Pattern match: "https://themes.googleusercontent.com/image?id=L1lcAxxz0CLgsDzixEprHJ2F38TyEjCyE3RSAjynQDks0lT1BDc1OxXKaTEdLc89HPvdB11X9FDw" Pattern match: "https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js" Pattern match: "http://www.w3.org/1999/xlink" Pattern match: "https://free-robux-generator-roblox.blogspot.com/search" Pattern match: "https://www.blogger.com" Pattern match: "http://www.offset.com/photos/394244" Pattern match: "https://www.blogger.com/go/report-abuse" Pattern match: "https://resources.blogblog.com/blogblog/data/res/2215927059-indie_compiled.js" Pattern match: "https://www.blogger.com/static/v1/widgets/2009384843-widgets.js" Pattern match: "www.blogger.com/rearrange?blogID\x3d7318622767188199316','//free-robux-generator-roblox.blogspot.com/','7318622767188199316" Pattern match: "https://www.blogger.com/static/v1/jsbin/3801281546-lbx.js"29:T11231," THE BEST ROBUX GENERATOR EVER Chrome, Firefox OS and Opera --> Windows Phone --> Can't find substitution for tag [blog.ieCssRetrofitLinks]--> [if IE]>

Posts

" "_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '7318622767188199316', 'title': 'THE BEST ROBUX GENERATOR EVER', 'url': 'https://free-robux-generator-roblox.blogspot.com/', 'canonicalUrl': 'https://free-robux-generator-roblox.blogspot.com/', 'homepageUrl': 'https://free-robux-generator-roblox.blogspot.com/', 'searchUrl': 'https://free-robux-generator-roblox.blogspot.com/search', 'canonicalHomepageUrl': 'https://free-robux-generator-roblox.blogspot.com/', 'blogspotFaviconUrl': 'https://free-robux-generator-roblox.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': '', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22THE BEST ROBUX GENERATOR EVER - Atom\x22 href\x3d\x22https://free-robux-generator-roblox.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22THE BEST ROBUX GENERATOR EVER - RSS\x22 href\x3d\x22https://free-robux-generator-roblox.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22THE BEST ROBUX GENERATOR EVER - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/7318622767188199316/posts/default\x22 /\x3e\n', 'meTag': '\x3clink rel\x3d\x22me\x22 href\x3d\x22https://www.blogger.com/profile/02019010055242595617\x22 /\x3e\n', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/8e0dbfe852f62d6c', 'plusOneApiSrc': 'https://apis.google.com/js/plusone.js', 'disableGComments': true, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'Twitter', 'key': 'twitter', 'shareMessage': 'Share to Twitter', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 300, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'index', 'pageName': '', 'pageTitle': 'THE BEST ROBUX GENERATOR EVER'}}, {'name': 'features', 'data': {'sharing_get_link_dialog': 'true', 'sharing_native': 'false'}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'THE BEST ROBUX GENERATOR EVER', 'description': '', 'url': 'https://free-robux-generator-roblox.blogspot.com/', 'type': 'feed', 'isSingleItem': false, 'isMultipleItems': true, 'isError': false, 'isPage': false, 'isPost': false, 'isHomepage': true, 'isArchive': false, 'isLabelSearch': false}}, {'name': 'widgets', 'data': [{'title': 'Search This Blog', 'type': 'BlogSearch', 'sectionId': 'search_top', 'id': 'BlogSearch1'}, {'title': 'THE BEST ROBUX GENERATOR EVER (Header)', 'type': 'Header', 'sectionId': 'header', 'id': 'Header1'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'page_body', 'id': 'Blog1', 'posts': [], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': ''}]}, 'footerBylines': [{'regionName': 'footer1', 'items': [{'name': 'comments', 'label': 'comments'}, {'name': 'icons', 'label': ''}]}, {'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}, {'regionName': 'footer3', 'items': [{'name': 'location', 'label': 'Location:'}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': ''}, {'name': 'comments', 'label': 'comments'}, {'name': 'icons', 'label': ''}, {'name': 'labels', 'label': ''}, {'name': 'location', 'label': 'Location:'}]}, {'title': '', 'type': 'PopularPosts', 'sectionId': 'page_body', 'id': 'PopularPosts1', 'posts': []}, {'type': 'Attribution', 'sectionId': 'footer', 'id': 'Attribution1'}, {'title': 'About Me', 'type': 'Profile', 'sectionId': 'sidebar_top', 'id': 'Profile1'}, {'title': '', 'type': 'ReportAbuse', 'sectionId': 'sidebar_bottom', 'id': 'ReportAbuse1'}]}]);"2a:T4d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADY0lEQVR42u2VS08TURiG+ytceVmYGI260gUmaNzJRuMlaBQXYlgYNTEhxI3RmGBwwQJj3BjcqISF8YIYTIyXyKVCBRQskrZaCr1QCvQy05ne4XW+AzOcGaY4rZK48CRPmtOe0+c93/k6tdn+9REMBkEEAgEN9b1QKITp6WmEw2HMzMwwIpEIZmdnMTc3x3A6nfjjAKrY7/drAUhuDEByPsD8/DzcbjdcLlfxEPEtNqwHFIgCTE5OsqBer9c8RFRZLO7d8Feh76RKUQB6TSaT2jWuChDZbIORvFLWdF8vYg1XlubhaWS+jSJaW8PmBaXMGecopJcvYLafoJNHo1EmzWQyEASBVcLn8+lDhJXFRrITXkSOVSH92bE0900gXLET8od3K3OTfTxqACq92kP0nsfj0YcIbrLBSF5pIqn7IyIX6tichPSa+flj6XOltGmqyN0WmO0nSBaLxRCPx5FIJBhUBVEUGVqAKWWxkYxSAd1cCRA4WAH5y7A2N9unY2qqqJx6Qgvg3WiDkdT4d908q/SANPIV/ppqNk+7XTDbx0M/2WJySZJWAniUxesB3XkxuS6AS1m8HtDPzkwuyzLD8pOwp6cH3d3dGr29vYy+vj7Y7Xb09/djYGCA4XA4MDg4iLGxMfZEVMVGeSqVsh6AmskI3a+K2X8EyakB+ZLz8nQ6bT0AfZERtbkI8X0XkpdOQnxwR1dus1Or8pIC8DK+q1WS95ogesYhnq3SiYvJ6alIWA7Ay/im0k7b0Y7kszaI54+vKVbl2WyWYTnAKuHyKbXThkMQDmxH8n7LmmJensvlrAfQyZZPyENCYf8OyCPDlsREPp+3HsAo4yGZPDIE4XAlxJsNlsREoVCwHsAo5CGZeL0e0qNWyJ1PIT1p+62YWFhYsB7AWFYdoQBie7YiNeSA9LAViboaxE8dgdjcBOHWDYi3G1eJicXFResBjGVVkd++RryqEolz1ZDfdCEnS+y0cudzCNeuQmp/jNld23RyEhM0LAfgS0pkgn4IF2uRbG5EdN9uZEVBV2Z2Ygr9yY6cf0onVuUlBVDvUSVRe5qFiB09hLS9Z9X9GkvNS/lhOQB/MiJRfxnxMyeQetWxprSYuOQAvMRMWIq0rAC8yExYirSsAEZZucKyA2Cdhu3/WB6/ADuvDu+77R/qAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":74,"unified_at_epoch_ms":1791172116223,"unified_at":"2026-10-05T03:48:36.223Z","metadata":{"hashes":{"sha256":"a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1","sha1":"09c09341ce4e5df1a69ddbb062259a484f96a9d6","md5":"1211adc72b045db14792400e829fb6a2","sha512":"d3eb3e9024362083b50ea6e9173bdb65431eb3f002d1a5f1f0dd9bc9e40eed70063c40b4e5487e2d0cc2e0581fa258f37c92d5e89f75d42ad46b2dc61372ac8c","ssdeep":"6144:BmAK+0rjj7InLPODtgKnkPm1pVrk4Cuyz7eSwKSP:BmB+0b7oLPQtrky3rpCuAG","ssdeep_chunks":["6144:BmAK+0r","6144:mAK+0rj","6144:AK+0rjj","6144:K+0rjj7","6144:+0rjj7I","6144:0rjj7In","6144:rjj7InL","6144:jj7InLP","6144:j7InLPO","6144:7InLPOD","6144:InLPODt","6144:nLPODtg","6144:LPODtgK","6144:PODtgKn","6144:ODtgKnk","6144:DtgKnkP","6144:tgKnkPm","6144:gKnkPm1","6144:KnkPm1p","6144:nkPm1pV","6144:kPm1pVr","6144:Pm1pVrk","6144:m1pVrk4","6144:1pVrk4C","6144:pVrk4Cu","6144:Vrk4Cuy","6144:rk4Cuyz","6144:k4Cuyz7","6144:4Cuyz7e","6144:Cuyz7eS","6144:uyz7eSw","6144:yz7eSwK","6144:z7eSwKS","6144:7eSwKSP","12288:BmAK+0r","12288:mAK+0rj","12288:AK+0rjj","12288:K+0rjj7","12288:+0rjj7I","12288:0rjj7In","12288:rjj7InL","12288:jj7InLP","12288:j7InLPO","12288:7InLPOD","12288:InLPODt","12288:nLPODtg","12288:LPODtgK","12288:PODtgKn","12288:ODtgKnk","12288:DtgKnkP","12288:tgKnkPm","12288:gKnkPm1","12288:KnkPm1p","12288:nkPm1pV","12288:kPm1pVr","12288:Pm1pVrk","12288:m1pVrk4","12288:1pVrk4C","12288:pVrk4Cu","12288:Vrk4Cuy","12288:rk4Cuyz","12288:k4Cuyz7","12288:4Cuyz7e","12288:Cuyz7eS","12288:uyz7eSw","12288:yz7eSwK","12288:z7eSwKS","12288:7eSwKSP","6144:BmB+0b7","6144:mB+0b7o","6144:B+0b7oL","6144:+0b7oLP","6144:0b7oLPQ","6144:b7oLPQt","6144:7oLPQtr","6144:oLPQtrk","6144:LPQtrky","6144:PQtrky3","6144:Qtrky3r","6144:trky3rp","6144:rky3rpC","6144:ky3rpCu","6144:y3rpCuA","6144:3rpCuAG"],"imphash":"Unknown"},"file_info":{"file_name":"IBM-free-robux-generator-super.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":274102,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1598121819000,"last_seen":1632262830000,"last_multi_scan":1632262830000}},"detections":{"summary":{"verdict":"malicious","score":74,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":3},"sandbox_signatures":{"informative_count":7,"suspicious_count":2,"malicious_count":0,"total":9},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"tactic":"Defense Evasion","technique":"DCShadow","attack_id":"T1207","attack_id_wiki":"https://attack.mitre.org/techniques/T1207","identifiers":[{"type":"informative","value":"Contains object with compressed stream data"}],"sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains object with compressed stream data","description":"$27","origin":"Static Parser","mitre_attack_id":"T1207","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"informative","category":"General","name":"PDF contains no significant text data on the first page(s)","description":"The input only has \"428\" visible characters on the first 3 page(s)","origin":"Static Parser","relevance":5,"id":"static-70","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"informative","category":"General","name":"PDF file has an embedded URL","description":"\"https://free-robux-generator-roblox.blogspot.com/\" (Based on: \"a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1.bin\")","origin":"File/Memory","relevance":3,"id":"string-25","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"urlref_httpsfree-robux-generator-roblox.blogspot.com\" has type \"HTML document ASCII text with very long lines\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains embedded objects that might be interesting to investigate","description":"Embedded object type \"/ObjStm\" (ID: 5, References: 16 0 R,18 0 R,12 0 R,20 0 R,22 0 R,25 0 R,26 0 R,27 0 R,28 0 R,29 0 R,30 0 R,31 0 R)\n Embedded object type \"/ObjStm\" (ID: 7, References: 9 0 R,10 0 R,6 0 R,10 0 R,8 0 R,13 0 R,8 0 R,9 0 R)\n Embedded object type \"/ObjStm\" (ID: 11, References: 6 0 R,13 0 R,14 0 R,34 0 R,35 0 R,12 0 R,37 0 R,23 0 R,27 0 R,26 0 R,25 0 R,29 0 R,38 0 R,12 0 R,34 0 R)\n Embedded object type \"/ObjStm\" (ID: 15, References: 17 0 R,40 0 R)\n Embedded object type \"/ObjStm\" (ID: 21, References: 41 0 R,42 0 R,44 0 R,45 0 R)\n Embedded object type \"/ObjStm\" (ID: 24, References: 47 0 R,48 0 R,50 0 R,51 0 R,53 0 R,54 0 R,56 0 R,57 0 R,58 0 R,60 0 R)\n Embedded object type \"/ObjStm\" (ID: 33, References: 61 0 R,31 0 R)","origin":"Static Parser","relevance":5,"id":"static-10","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/78 reputation engines marked \"http://purl.org\" as malicious (1% detection rate)\n 1/78 reputation engines marked \"http://purl.org/dc/elements/1.1\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":20,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5f41675a69debf18ac3c8046","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":74,"submit_name":"IBM-free-robux-generator-super.pdf","analysis_start_time":"2020-08-22T18:43:46+00:00","indicators_count":{"informative":7,"suspicious":2,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}],"processes":[{"pid":228,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\IBM-free-robux-generator-super.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","uid":"00126807-00000228","icon":"$2a"}],"all_imported_dlls":["msvcrt.dll","advapi32.dll","imm32.dll","msctf.dll","shell32.dll","comctl32.dll","KernelBase.dll","rpcrt4.dll","ole32.dll","kernel32.dll","gdi32.dll","sechost.dll","AcroRd32.dll","AGM.dll","ntdll.dll","msvcp120.dll","lpk.dll","shlwapi.dll","user32.dll","usp10.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpsfree-robux-generator-roblox.blogspot.com","sha256":"2544f73531038cb47753ac6b4f1adf1f4d8fa2067b4abda9cb22ad3e8a26afa0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f41675a69debf18ac3c8046"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5f41675a69debf18ac3c8046"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample a2cdf98e739f… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a2cdf98e739f…. Threat score 74/100. 0/28 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample a2cdf98e739f… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a2cdf98e739f…. Threat score 74/100. 0/28 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a2cdf98e739f3ddc1f417e29e16ef9fee9560eb5c2209b666aeecf7d4f66d1f1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample a2cdf98e739f… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a2cdf98e739f…. Threat score 74/100. 0/28 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]