MALICIOUS — free-robux-scan_GM431946152.pdf

MALICIOUS — free-robux-scan_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 5 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 497c08a79da53b90a9d632a5c84ce6daf56059ae4578222bc93c546af44c3657
• SHA-1: 26eda4d3ccaeb69c6114a40ffcd6652474b3c7bb
• MD5: b2e4b84c68b4315ed229ee95901c743a
• ssdeep: 768:A6mF6C/HPQTnO0fiERs03ggHgt62+oRRIIIIIIh4i2+fDOVbCFVAZMg:Ap6C/H+Sy/QaKrIIIIIIhY+fDgbAVAWg
• TLSH: T1B0339FF3115BCD5CBA9A6F43A9B6155DB08AE7882162DF40D4C8793CC07CABD7B10A21
• Submitted as: free-robux-scan_GM431946152.pdf
• File type: pdf · Size: 48662 bytes
• Verdict: malicious (75/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!B2E4B84C68B4
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1112
• T1105
• T1566.002

Why this verdict

The malicious score of 75/100 is the fusion of 7 weighted signals:

• Contacted 20 external host(s) at runtime (3 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded link rated suspicious by URL analysis: http://mtsn-baranti.com/perpus/repository/www-coin-master_GM406889139.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://netcdn.tw/app/431946152/free-robux-scan-game-hack, http://mtsn-baranti.com/perpus/repository/how-do-you-hack-roblox_GM431946152.pdf, http://mtsn-baranti.com/perpus/repository/coin-master-hack-activegamer_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9703 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• searchapp.bundleassets.example
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• desktop-hsgcbep
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - 68478f6f1b64955d0df2ec4cf2f4c5f2d23894856053a3c46d7b4969fbecd06c
• C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\24191060c8f7e7ec960040f03701e021.png - cef504e6bcf54a837885c690ee7c619040d9ec1aa573fc4ebfe2a241de5738ae
• root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

• https://netcdn.tw/app/431946152/free-robux-scan-game-hack
• http://mtsn-baranti.com/perpus/repository/how-do-you-hack-roblox_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-hack-activegamer_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/free-free-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/minecraft-bedrock-edition-free_GM479516143.pdf
• http://mtsn-baranti.com/perpus/repository/free-roblox-promo-codes-for-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/free-roblox-followers_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/mcpe-master-hack-unlimited-coins-download_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-rewards_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/www-coin-master_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/are-minecraft-realms-free_GM479516143.pdf
• http://mtsn-baranti.com/perpus/repository/roblox-hacks-and-cheats_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-hack-tool-v1-9-download-free_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-cheats-without-verification_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/minecraft-client_GM479516143.pdf
• http://mtsn-baranti.com/perpus/repository/free-24-7-minecraft-server_GM479516143.pdf
• http://mtsn-baranti.com/perpus/repository/download-roblox-free-for-android_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-daily-free-spins-and-coins_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/microsoft-bing-free-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/cmaster-club-coin-master-hack-tool_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-free-coins-link_GM406889139.pdf
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

• netcdn.tw
• mtsn-baranti.com

Embedded IP addresses

• 172.172.255.217
• 20.184.175.0
• 52.168.117.174
• 4.150.223.115
• 85.210.196.11
• 172.172.255.218
• 13.69.116.108
• 52.230.59.222
• 52.123.252.247
• 20.165.94.46
• 52.110.12.40
• 4.230.171.124
• 4.247.188.233
• 203.26.79.13
• 172.178.240.162
• 135.232.92.97
• 74.179.77.204
• 52.123.128.14
• 52.123.252.239
• 20.42.179.204

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report