SUSPICIOUS — free-spin-link-for-coin-master-game_GM406889139.pdf

SUSPICIOUS — free-spin-link-for-coin-master-game_GM406889139.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 6785fa5ed9c3991201f68e3013422ab2d604dfb0f8a51022b3824efa592bc476
• SHA-1: d6b47916a170c27f310eb6fe3e69f96292297b9c
• MD5: a2f81816b4a8fa61ac0617e11a47c7ab
• ssdeep: 768:rqx2MGQRdvnwvzlPkMIR24y61b4PcpHt00UfyRd8Zz:R5Q/clcMIRby61b4EpNbSs8Zz
• TLSH: T12B306DF36197CC1C768A9F135DB625AD64C9E2856022DA4050D83A7CD07CAFE7F10A36
• Submitted as: free-spin-link-for-coin-master-game_GM406889139.pdf
• File type: pdf · Size: 36808 bytes
• Verdict: suspicious (44/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!A2F81816B4A8

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: http://netcdn.tw/app/406889139/free-spin-link-for-coin-master-game-game-hack, http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/how-to-get-free-clothing-on-roblox_GM431946152.pdf, http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/free-roblox-injector-for-cb_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://netcdn.tw/app/406889139/free-spin-link-for-coin-master-game-game-hack
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/how-to-get-free-clothing-on-roblox_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/free-roblox-injector-for-cb_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/nathorix-free-robux_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/roblox-com-free-play_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/coinmasterhack-club_GM406889139.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/roblox-hack-no-human-verification-2021-android_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/how-to-hack-into-your-lost-roblox-account_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/free-robux-hack-no-verification-or-survey_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/open-coin-master_GM406889139.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/spin-coin-master-free_GM406889139.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/how-to-get-free-robux-on-discord_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/roblox-apocalypse-rising-spawn-hack_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/how-do-u-get-free-robux-2021_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/free-robux-no-verification-no-download-2021_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/robux-free-c_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/how-to-get-free-obc-roblox_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/free-robux-rbx-membership-claims-and-generators_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/free-robux-thumbnail_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/free-robux-scams_GM431946152.pdf
• http://assets.dpt.go.th/dptda/ckfinder/userfiles/files/roblox-toy-codes-free_GM431946152.pdf

Embedded domains

• netcdn.tw
• assets.dpt.go.th

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report