MALICIOUS — cheats-roblox-rocitizens_GM431946152.pdf

MALICIOUS — cheats-roblox-rocitizens_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 4 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8e0a8dd70748aad0f8797f6e53e172e26e27269ac15ebf1845225011624a3fd8
SHA-1: 0806acbfc814eb7a05c5ea6ecaab8d36eaaa35a5
MD5: 22d523a424a6df4b7dc2cc9dc4940766
ssdeep: 768:oEs7uC8/KxsY4MbDPDNbXE+fnd/V+kN5jwppYJJfHgG/kHPGRdQNIe6:ZIuCL4M3PDN4+fd/z5kppQZAGfPe6
TLSH: T1722F6CF71097DC4C76894B036DE7602968CEE38860BBE61444E4776CE0BC9BE2F51A21
Submitted as: cheats-roblox-rocitizens_GM431946152.pdf
File type: pdf · Size: 35538 bytes
Verdict: malicious (75/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
Emsisoft (Emergency Kit): PDF.Spam.Heur.2
Trellix Stinger (McAfee): PDF/Phish-TWM!22D523A424A6

MITRE ATT&CK

Why this verdict

The malicious score of 75/100 is the fusion of 7 weighted signals:

Contacted 20 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://www.biochemix.com/uploaded_files/userfiles/files/free-powerful-gun-on-nuclear-plant-tycoon-roblox_GM431946152.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://netcdn.co/app/431946152/cheats-roblox-rocitizens-game-hack, http://www.biochemix.com/uploaded_files/userfiles/files/free-powerful-gun-on-nuclear-plant-tycoon-roblox_GM431946152.pdf, http://www.biochemix.com/uploaded_files/userfiles/files/roblox-how-to-get-the-circuit-breaker-for-free_GM431946152.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9707 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
searchapp.bundleassets.example
outlook.cloud.microsoft
desktop-hsgcbep
ntp.ubuntu.com
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\990d6f8781b32f3a6edda222625f51a7.png - 48a01c9b7fbb6dd91e409be69b7a83da617fd6989270334e1449a04f8bb80b2a
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - fecf6c9c5b1a7e3af2e1258345449fc30bd40fa6f0ab52657cd5342cec4f43e6
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://netcdn.co/app/431946152/cheats-roblox-rocitizens-game-hack
http://www.biochemix.com/uploaded_files/userfiles/files/free-powerful-gun-on-nuclear-plant-tycoon-roblox_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/roblox-how-to-get-the-circuit-breaker-for-free_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-hack-no-human-verification-2021_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-tiktok-likes-no-human-verification-or-download_GM835599320.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-free-spins-and-coins-today-gift-reward_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-free-spins-and-coins-daily_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/cheats-on-roblox-game_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/tiktok-free-generator_GM835599320.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/roblox-free-animation-ninja_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-free-daily-spins-and-coins_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master-free-daily-spins_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/codes-that-give-you-free-robux_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/lazyblocks-com-free-robux_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-robux-no-human-verification_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/coin-master--hack_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-minecraft-skin-maker_GM479516143.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/free-robux-websites-no-human-verification_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/easy-free-spins-coin-master_GM406889139.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/how-to-get-free-robux-without-download-apps-or-survey_GM431946152.pdf
http://www.biochemix.com/uploaded_files/userfiles/files/how-to-get-free-robux-2021_GM431946152.pdf
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

netcdn.co
www.biochemix.com

Embedded IP addresses

48.211.4.16
72.145.35.109
74.179.77.204
4.247.188.233
52.123.252.203
57.155.101.212
52.110.12.54
52.110.12.56
4.230.171.124
4.144.132.223
20.165.94.63
4.207.44.75
20.236.44.162
74.178.232.29
52.123.129.14
72.153.5.97
203.26.79.13
52.123.252.194
52.148.114.188
40.104.4.2

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report