MALICIOUS — how-to-get-free-admin-in-roblox-prison-life_GM431946152.pdf

MALICIOUS — how-to-get-free-admin-in-roblox-prison-life_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 5452a154da415c8d39ed692c66f8617db5ede477aa52440370a3920e5d906c28
• SHA-1: 51dc9deebcba8d9759c1f21b472177de3b36b215
• MD5: dd97ca2bfc5d22f48e3a59dad7cc2daf
• ssdeep: 768:0LQRxHxsry8WNZSHx1Y/1vGWtat/x09k3TZfg:DXHoWzJ/1vba4u3dfg
• TLSH: T1872F7DF7019BDC1C3B86AB43ACBA551D71CAD3C86172DA1560E8362D807CAEEBB50431
• Submitted as: how-to-get-free-admin-in-roblox-prison-life_GM431946152.pdf
• File type: pdf · Size: 35683 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!DD97CA2BFC5D

Why this verdict

The malicious score of 92/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:PDF/Phish.CFN!MTB (rule Trojan:PDF/Phish.CFN!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.2 (rule PDF.Spam.Heur.2) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PDF/Phish-TWM!DD97CA2BFC5D (rule PDF/Phish-TWM!DD97CA2BFC5D) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: http://netcdn.co/app/431946152/how-to-get-free-admin-in-roblox-prison-life-game-hack, http://mtsn-baranti.com/perpus/repository/earn-points-for-robux_GM431946152.pdf, http://mtsn-baranti.com/perpus/repository/stickmasterluke-free-robux_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://netcdn.co/app/431946152/how-to-get-free-admin-in-roblox-prison-life-game-hack
• http://mtsn-baranti.com/perpus/repository/earn-points-for-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/stickmasterluke-free-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/how-to-cheat-money-in-roblox-lumber-tycoon_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/how-to-get-free-robux-1-min_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/free-robux-mod_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/minecraft-java-edition-download-free_GM479516143.pdf
• http://mtsn-baranti.com/perpus/repository/yyoutube-robux-hacks-2021_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/minecraft-complete-handbook_GM479516143.pdf
• http://mtsn-baranti.com/perpus/repository/how-to-change-your-roblox-username-for-free-2021_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/how-to-get-free-hair-on-roblox_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/prison-breaker-hack-script-roblox-pastebin_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/roblox-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/free-robux-free-robux-free-robux-free-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-daily-spins_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/roblox-studio-free-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/best-free-spins-for-coin-master_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/coin-master-hack-injection_GM406889139.pdf
• http://mtsn-baranti.com/perpus/repository/free-robux-without-doing-anything_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/microsoft-bing-free-robux_GM431946152.pdf
• http://mtsn-baranti.com/perpus/repository/free-robux-serveys_GM431946152.pdf

Embedded domains

• netcdn.co
• mtsn-baranti.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report