SUSPICIOUS — robux-hack-no-human-verification_GM431946152.pdf

SUSPICIOUS — robux-hack-no-human-verification_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 4526309177f763992f25d11dbf1ab3bd965f5543b2800d10fd0fd46b61613d2a
• SHA-1: 142b565310a748ce5f494c35959b835a68fceefb
• MD5: ae43bf14e1e033ceac298726643898e9
• ssdeep: 768:jllFvsA2bc+BlK3XPIkpO6pUyfAkeaRIOqka:5Hl+cAiO6ptSuIdka
• TLSH: T1B8308DF3105BCC4C6E8A8F47B976116AB1C6C3886073C902D5DC7A3D80BD9AE6F60921
• Submitted as: robux-hack-no-human-verification_GM431946152.pdf
• File type: pdf · Size: 36746 bytes
• Verdict: suspicious (44/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!AE43BF14E1E0

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: http://netcdn.tw/app/431946152/robux-hack-no-human-verification-game-hack, http://perpustakaan.pa-jember.go.id/repository/how-to-get-free-robux-without-doing-anything_GM431946152.pdf, http://perpustakaan.pa-jember.go.id/repository/coin-master-free-raid-link_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://netcdn.tw/app/431946152/robux-hack-no-human-verification-game-hack
• http://perpustakaan.pa-jember.go.id/repository/how-to-get-free-robux-without-doing-anything_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/coin-master-free-raid-link_GM406889139.pdf
• http://perpustakaan.pa-jember.go.id/repository/roblox-free-level-6-exploit_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/coin-master-hack-online-no-human-verification_GM406889139.pdf
• http://perpustakaan.pa-jember.go.id/repository/minecraft-texture-packs-free-download_GM479516143.pdf
• http://perpustakaan.pa-jember.go.id/repository/minecraft-pocket-edition-apk-free-download_GM479516143.pdf
• http://perpustakaan.pa-jember.go.id/repository/is-minecraft-java-edition-free_GM479516143.pdf
• http://perpustakaan.pa-jember.go.id/repository/reddit-how-to-get-free-robux_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/free-coin-master-spins-daily_GM406889139.pdf
• http://perpustakaan.pa-jember.go.id/repository/roblox-mad-city-comment-cheat_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/coin-master-daily-free-spins-link-today-2021_GM406889139.pdf
• http://perpustakaan.pa-jember.go.id/repository/speed-run-roblox-hack_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/roblox-shinobi-life-cheat-engine_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/code-roblox-superhero-tycoon-promo-free-admin-code-tycoon_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/hack-para-roblox-de-romper-pardedes_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/how-to-get-400-robux-for-free_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/cheat-codes-for-adopt-me-roblox_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/roblox-pet-simulator-hack-2021_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/get-free-robux-without-doing-anything_GM431946152.pdf
• http://perpustakaan.pa-jember.go.id/repository/robux-game_GM431946152.pdf

Embedded domains

• netcdn.tw
• perpustakaan.pa-jember.go.id

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report