SUSPICIOUS — free-robux-generator-2021-no-survey_GM431946152.pdf
SUSPICIOUS — free-robux-generator-2021-no-survey_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 5 of 53 detection engines flagged it.
Identification
- SHA-256:
98b049620ee47a2e1c71d176c82e1bfacef254a9f968cb5543209ab5bc9f4827 - SHA-1:
ee38dd8cdc40831655b4c5878f0e821c556a02cb - MD5:
7c47f68dd8e7f373329aa5af04e0be7e - ssdeep:
768:TP5nXdbyfseWpx8CzNeo/Uwl3nvtBSH9djyy1JNrdg:rl5zeo/5ftBSH9dt5rC - TLSH:
T1D3307DF7009BCC0C6A4F5F03AD7B152DB58AD64871629548A0D8B67D80AC7FEAF20961 - Submitted as: free-robux-generator-2021-no-survey_GM431946152.pdf
- File type: pdf · Size: 36363 bytes
- Verdict: suspicious (44/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
- Emsisoft (Emergency Kit): PDF.Spam.Heur.2
- Trellix Stinger (McAfee): PDF/Phish-TWM!7C47F68DD8E7
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: http://netcdn.co/app/431946152/free-robux-generator-2021-no-survey-game-hack, http://111.68.26.74/widyapustaka/repository/twitter-coin-master-free-spins-link_GM406889139.pdf, http://111.68.26.74/widyapustaka/repository/google-moon-active_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://netcdn.co/app/431946152/free-robux-generator-2021-no-survey-game-hack
- http://111.68.26.74/widyapustaka/repository/twitter-coin-master-free-spins-link_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/google-moon-active_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/free-way-to-get-p-in-plaza-game-on-roblox_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/roblox-avatar-editor-free_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/coin-master-free-spins-2021_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/free-roblox-avatar-ideas_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/how-to-get-free-clothes-from-catalog-roblox_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/how-do-we-get-free-robux_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/coin-master-hacks-no-downloading_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/roblox-one-piece-unleashed-hack_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/robux-now_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/how-do-u-get-free-robux-2021_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/how-to-get-free-spins-grom-coin-master_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/rbx-earn_GM431946152.pdf
- http://111.68.26.74/widyapustaka/repository/free-coin-master-spins_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/coin-master-game-hack-kaise-kare_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/coin-master-hacks-for-iphone_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/coin-master-free-spins-link-download-free_GM406889139.pdf
- http://111.68.26.74/widyapustaka/repository/free-robux-roblox-promo-codes_GM431946152.pdf
Embedded domains
- netcdn.co
Embedded IP addresses
- 111.68.26.74
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report