SUSPICIOUS — how-do-you-get-free-robux-without-paying_GM431946152.pdf
SUSPICIOUS — how-do-you-get-free-robux-without-paying_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.
Identification
- SHA-256:
14a8afe1f98de0efd1264026354d065c497e829bf50f41c6aff2654802aa8be3 - SHA-1:
043cd51a1bcccdb8ea0a72dcd973cbc90a135e8b - MD5:
9b0eb4613fc02e5b20782745fdb427ed - ssdeep:
768:4rbRzbbC9HG45sleCfPHKIUmt6pGm/EWXrlsQlaT9Kr6l+:abRzS9HGjHHKDmt6pGCblTGM+l+ - TLSH:
T1BE307DF3418BDC5C764BCF1359BA65A9F089C388A4A3DA4165CC372C80AC5AD7F21522 - Submitted as: how-do-you-get-free-robux-without-paying_GM431946152.pdf
- File type: pdf · Size: 36595 bytes
- Verdict: suspicious (44/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
- Emsisoft (Emergency Kit): PDF.Spam.Heur.2
- Trellix Stinger (McAfee): PDF/Phish-TWM!9B0EB4613FC0
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: http://netcdn.tw/app/431946152/how-do-you-get-free-robux-without-paying-game-hack, http://olimpik.mk/imagescke/upload/files/coin-master-free-spins-for-today_GM406889139.pdf, http://olimpik.mk/imagescke/upload/files/orewards-com-free-robux_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://netcdn.tw/app/431946152/how-do-you-get-free-robux-without-paying-game-hack
- http://olimpik.mk/imagescke/upload/files/coin-master-free-spins-for-today_GM406889139.pdf
- http://olimpik.mk/imagescke/upload/files/orewards-com-free-robux_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/free-robux-no-verify_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/coin-master-free-spin-and-coin-link-haktuts-hacking-news_GM406889139.pdf
- http://olimpik.mk/imagescke/upload/files/how-to-get-free-minigun-in-roblox-human-vs-zombies_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/how-do-u-hack-roblox_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/roblox-script-hack_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/roblox-maid-paintball-2-free-robux_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/hack-roblox-lumber-tycoon-2-btools_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/coin-master-twitter_GM406889139.pdf
- http://olimpik.mk/imagescke/upload/files/admin-robux-hack_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/roblox-free-admin-exploit_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/free-robux-on-phone_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/roblox-robux-page_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/how-to-get-free-robux-for-free_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/get-free-robux-today_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/hack-coin-master-without-root_GM406889139.pdf
- http://olimpik.mk/imagescke/upload/files/can-i-get-minecraft-for-free_GM479516143.pdf
- http://olimpik.mk/imagescke/upload/files/free-robux-coes_GM431946152.pdf
- http://olimpik.mk/imagescke/upload/files/how-do-you-get-free-roblox_GM431946152.pdf
Embedded domains
- netcdn.tw
- olimpik.mk
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report