SUSPICIOUS — blox-fish-free-robux_GM431946152.pdf

SUSPICIOUS — blox-fish-free-robux_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 3e883d95c6e190ccd5bc03ad33030835016b87f9c3476ce0f7397c3538dc3daa
• SHA-1: 5453aae8b715c20bfbb2b31474db8866c7843e2f
• MD5: bf1b5ebc48fcec2ee7f6437c39be6631
• ssdeep: 768:7Rv7lCjyy65AYNsyz/f5B1QgL+oJz8y2/cjFzStghE:JlI6L57PJzb2/QhE
• TLSH: T18531C0FB214BCD5C75C0C72395295475718A9AD93160C610A6D83A7CC46A2FEEF10F71
• Submitted as: blox-fish-free-robux_GM431946152.pdf
• File type: pdf · Size: 42881 bytes
• Verdict: suspicious (44/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!BF1B5EBC48FC

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://netcdn.xyz/app/431946152/blox-fish-free-robux-game-hack - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://netcdn.xyz/app/431946152/blox-fish-free-robux-game-hack

Embedded domains

• netcdn.xyz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report