SUSPICIOUS — free-attacks-on-coin-master_GM406889139.pdf

SUSPICIOUS — free-attacks-on-coin-master_GM406889139.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 5268fba84359b26e1fbcd2291485dd8cb26b5e57a82e9c4c9ed594f6f0f75833
• SHA-1: d4c062a401f9a9946635bf803ff7c1d754ca7739
• MD5: 86278267665838e22cd347c7dc97ccdc
• ssdeep: 768:qvpVZdoTv7taUDBOzocPXwxn4P1SB62yq311UBFGPtIYD:qjGHDIAx4P1SB6a11ULUtIYD
• TLSH: T1F12F7CF74187CD1C6A8BCB03EDF6605E548DC3893272DA604598A76CE0BD9BE7B50821
• Submitted as: free-attacks-on-coin-master_GM406889139.pdf
• File type: pdf · Size: 35219 bytes
• Verdict: suspicious (44/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!862782676658
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: http://netcdn.tw/app/406889139/free-attacks-on-coin-master-game-hack, https://www.espritroue.fr/ckfinder/userfiles/files/hack-coin-master-free-spins_GM406889139.pdf, https://www.espritroue.fr/ckfinder/userfiles/files/how-to-get-free-robux-on-phone_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://netcdn.tw/app/406889139/free-attacks-on-coin-master-game-hack
• https://www.espritroue.fr/ckfinder/userfiles/files/hack-coin-master-free-spins_GM406889139.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/how-to-get-free-robux-on-phone_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/roblox-group-free-robux_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/how-to-change-name-in-roblox-for-free-2021_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/robux-free-com_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/how-to-get-free-admin-on-roblox-hack_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/free-robux-no-verification-needed_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/roblox-free-robux-no-human-verification_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/how-to-get-free-robux-on-roblox-without-downloading-anything_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/cheats-for-rake-classic-edition-roblox_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/hack-using-cheat-engine-roblox_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/free-robux-link_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/free-coin-master-links_GM406889139.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/roblox-hack-codes_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/coin-master-free-spins-link-whatsapp-group_GM406889139.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/i-got-hacked-on-roblox_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/earn-robux-websites_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/free-robux-games-on-roblox_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/dll-roblox-hack-2021-february_GM431946152.pdf
• https://www.espritroue.fr/ckfinder/userfiles/files/free-coins-coin-master-blog_GM406889139.pdf

Embedded domains

• netcdn.tw
• www.espritroue.fr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report