SUSPICIOUS — free-robux-just-enter-username_GM431946152.pdf

SUSPICIOUS — free-robux-just-enter-username_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 1bfc2d481817b1f09b26b03bf7b77ea13997153c4c2e06b606284fcde12fb9cd
• SHA-1: c1f9f5c1a0e29149c2dccec3de283825bbebabdb
• MD5: cec8cad7aa3205a0d2ad0c4a5c04717f
• ssdeep: 768:T36U0wopWJssVOSt4SXiysvMN5D1IBLRMu6hUeui4O:TL4SXgv+5CLWu6hUy4O
• TLSH: T1FD308CF3019BDC4C2A8A5B43A9762529B5C9D3CC7576C701A1DC723CC07DABE2E209A5
• Submitted as: free-robux-just-enter-username_GM431946152.pdf
• File type: pdf · Size: 36048 bytes
• Verdict: suspicious (44/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!CEC8CAD7AA32
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: http://netcdn.tw/app/431946152/free-robux-just-enter-username-game-hack, http://perpustakaan.pn-raha.go.id/repository/free-robux-codes-no-verification_GM431946152.pdf, http://perpustakaan.pn-raha.go.id/repository/robux-javascrip-hack_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://netcdn.tw/app/431946152/free-robux-just-enter-username-game-hack
• http://perpustakaan.pn-raha.go.id/repository/free-robux-codes-no-verification_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/robux-javascrip-hack_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/free-robux-generator-2021-no-human-verification-or-survey_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/coin-master-hack-unlimited-spins-game-download_GM406889139.pdf
• http://perpustakaan.pn-raha.go.id/repository/minecraft-hack-2021_GM479516143.pdf
• http://perpustakaan.pn-raha.go.id/repository/how-to-get-free-robux-without-any-verification_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/roblox-promo-code-to-get-free-robux_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/coin-master-free-daily-spins_GM406889139.pdf
• http://perpustakaan.pn-raha.go.id/repository/how-to-change-my-name-in-roblox-for-free_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/pop-slots-free-vegas-casino-slots-machine-game-coin-master_GM406889139.pdf
• http://perpustakaan.pn-raha.go.id/repository/roblox-help-free-robux_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/roblox-how-to-increase-speed-using-cheat-engine_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/how-ot-get-free-clothrs-in-the-catalog-on-roblox_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/roblox-hack-peoples-account-2021_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/archery-master-3d-hack-unlimited-coins-cheats_GM406889139.pdf
• http://perpustakaan.pn-raha.go.id/repository/coin-master-apk-hacked-3526_GM406889139.pdf
• http://perpustakaan.pn-raha.go.id/repository/free-robux-codes-no-verification-2021_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/minecraft-windows-10-free-trial_GM479516143.pdf
• http://perpustakaan.pn-raha.go.id/repository/roblox-tix-robux-hack-download_GM431946152.pdf
• http://perpustakaan.pn-raha.go.id/repository/minecraft-xbox-free_GM479516143.pdf

Embedded domains

• netcdn.tw
• perpustakaan.pn-raha.go.id

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report