SUSPICIOUS — coin-master-hack-ios-reddit_GM406889139.pdf

SUSPICIOUS — coin-master-hack-ios-reddit_GM406889139.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (66/100). 4 of 50 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 47382154249797bcee1bba683f935a35013fbaceca7f70148b9906a2e4eac601
SHA-1: 059816a64487a6b6aed9fbc670d206a7543caaab
MD5: 8886d292b2efc811202bd67650db4550
ssdeep: 768:qTA0oPs/4evKI/Gx9bi37JVNJLKQpPpiDy:eoRrwVVPmw0Dy
TLSH: T1A42F7DF74097DD4C764B8B0329F7502E60C9E348A2B6DA5094E8B62CE07C5BE7F12612
Submitted as: coin-master-hack-ios-reddit_GM406889139.pdf
File type: pdf · Size: 34737 bytes
Verdict: suspicious (66/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
Emsisoft (Emergency Kit): PDF.Spam.Heur.2
Trellix Stinger (McAfee): PDF/Phish-TWM!8886D292B2EF

MITRE ATT&CK

Why this verdict

The suspicious score of 66/100 is the fusion of 7 weighted signals:

Embedded link rated suspicious by URL analysis: http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-daily-free-spins-link-today-facebook_GM406889139.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://netcdn.tw/app/406889139/coin-master-hack-ios-reddit-game-hack, http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-daily-free-spins-link-today-facebook_GM406889139.pdf, http://www.biochemix.com/uploaded_files/userfiles/files/free-coins-coin-master-blog_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 18 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9676 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
searchapp.bundleassets.example
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
79.243.254.169.in-addr.arpa
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
255.255.254.169.in-addr.arpa
251.0.0.224.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - b22c444b5bb9f320a14ef75d16dcba58e2b4bc57ac3ee9b2d6f844c4ac0c04e1
C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\ef232946019a869892934a87eb00c607.png - 3d98084aa7a8294c2b91e7c86d32656d9afe32548e96ef8d7852a967ff6ba45a
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://netcdn.tw/app/406889139/coin-master-hack-ios-reddit-game-hack
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-daily-free-spins-link-today-facebook_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-coins-coin-master-blog_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/how-to-get-2-robux-for-free_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/what-is-a-robux_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/robux-codes-generator-no-human-verification_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/minecraft-server-hacks_GM479516143.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/nonsense-diamond-hack-roblox_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/roblox-promo-codes-2021-robux_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-robux-working_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/tiktok-for-free_GM835599320.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/apk-hack-coin-master_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/no-human-verification-hack-for-coin-master_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/how-to-earn-free-robux_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-cheats-free_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/how-to-get-free-coins-in-minecraft_GM479516143.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/how-to-get-free-robux-in-2021_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/how-to-become-a-hacker-in-roblox_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-spins-on-coin-master-cheat_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-robux-pins_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/25-roblox-gift-card-free-codes-2021_GM431946152.pdf
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

netcdn.tw
www.biochemix.com

Embedded IP addresses

72.154.7.114
52.123.129.14
20.184.175.15
52.168.117.174
172.178.240.163
52.110.12.24
4.247.188.233
104.46.162.224
74.178.240.61
74.179.71.159
20.231.239.246
74.178.76.54
20.42.179.192
4.247.188.224
135.233.95.144
162.159.36.2
142.250.195.163
4.230.171.124

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report