SUSPICIOUS — bux-free-robux_GM431946152.pdf

SUSPICIOUS — bux-free-robux_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 3cb9d183ffde87d10a817114ca5d186bd640901459228f95197c0e462631bfbd
• SHA-1: bbf448bb5ca9c4af9b478e3e3032b05f3ae99dd0
• MD5: 8509ac93a5828825014ed6bc0143c54a
• ssdeep: 768:YK0b9JrE6YqpiYCYYmZiLVsVPqqqhjlhlFanU6IKSfb9Wo4Q:Ye6fzbZiLaPmXlD6I3jF4Q
• TLSH: T1F130D0FB611ADE5C36065F03BBF52818705D6AC87020DE1451D8BE6CC824AEDEB91BB1
• Submitted as: bux-free-robux_GM431946152.pdf
• File type: pdf · Size: 38286 bytes
• Verdict: suspicious (44/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!8509AC93A582

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://netcdn.xyz/app/431946152/bux-free-robux-game-hack - static signal, weight 0.35, confidence 0.60
• Document active content: additional-actions, uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://netcdn.xyz/app/431946152/bux-free-robux-game-hack

Embedded domains

• netcdn.xyz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report