SUSPICIOUS — free-camp-2-on-roblox_GM431946152.pdf

SUSPICIOUS — free-camp-2-on-roblox_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 162de8ffe6dc742682d25a8a693d8f3b5290ff180738e610dc35fd1b69f3c3d4
• SHA-1: 2c2da3f8fbe1652297eaead15529b1025bc7d6ba
• MD5: 52fe10c50ea2f06607721de65408e3f6
• ssdeep: 768:V9ISAIVLzMcIsrsI28i+V9b2skZpKbDlHqllXY+i:VmSA2PGsI8iU96sIpKbDlHiY+i
• TLSH: T15D2F6BF3019BCC1C7A4B8F0BEBB7165DB4EAD3896066CD904498366C902C6AFBA40561
• Submitted as: free-camp-2-on-roblox_GM431946152.pdf
• File type: pdf · Size: 34372 bytes
• Verdict: suspicious (44/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!52FE10C50EA2
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: http://netcdn.co/app/431946152/free-camp-2-on-roblox-game-hack, https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/descargar-coin-master-hackeado_GM406889139.pdf, https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/coin-master-hack-pc-2021_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://netcdn.co/app/431946152/free-camp-2-on-roblox-game-hack
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/descargar-coin-master-hackeado_GM406889139.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/coin-master-hack-pc-2021_GM406889139.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/how-to-buy-robux-for-free_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/free-coins-and-spins-in-coin-master_GM406889139.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/coin-master-tiradas-gratis-link_GM406889139.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/free-robux-redeem-codes-2021_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/free-robux-app_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/minecraft-free-computer-game_GM479516143.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/roblox-hack-me-robux_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/no-scam-free-robux_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/coin-master-hack-cydia_GM406889139.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/how-to-use-scripts-in-roblox-hack_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/how-do-i-get-free-robux_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/free-spins-coin-master-apple_GM406889139.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/minecraft-xray-hack_GM479516143.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/coin-master-app-free-download_GM406889139.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/roblox-free-privat-server_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/free-robux-no-verification_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/roblox-see-in-a-blocked-inventory-hack_GM431946152.pdf
• https://daring.mtsn7sumedang.sch.id/__statics/gudangsoal/files/free-minecraft-server-hosting-with-plugins_GM479516143.pdf

Embedded domains

• netcdn.co
• daring.mtsn7sumedang.sch.id

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report