MALICIOUS — free-robux-kid-friendly_GM431946152.pdf

MALICIOUS — free-robux-kid-friendly_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 5 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9db098576e15c361450e44d2b55f4745bf4e7f021b928710a850f1d9c86edbba
SHA-1: 29879408552f7580a3d5446bad9fdb41eeeb820a
MD5: 6e82ea01c2d7ff352ecd83237cd26376
ssdeep: 768:RUBDQa0bnsQZ+oc4OJVzttdcFlslwK6n1llHFySvSCJA:RVa0b2oHOJVj2FGeK6njySvzJA
TLSH: T1782F7EF740CBDC5C7E869F0399B7205C748AF79861228A50A1D9372C917C3DEAF50A22
Submitted as: free-robux-kid-friendly_GM431946152.pdf
File type: pdf · Size: 34921 bytes
Verdict: malicious (75/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
Emsisoft (Emergency Kit): PDF.Spam.Heur.2
Trellix Stinger (McAfee): PDF/Phish-TWM!6E82EA01C2D7
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

Why this verdict

The malicious score of 75/100 is the fusion of 7 weighted signals:

Contacted 22 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded link rated suspicious by URL analysis: http://library.futureuniversity.com/repository/how-to-get-robux-for-free-2021_GM431946152.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: http://netcdn.tw/app/431946152/free-robux-kid-friendly-game-hack, http://library.futureuniversity.com/repository/how-to-get-robux-for-free-2021_GM431946152.pdf, http://library.futureuniversity.com/repository/coin-master-free-link-app_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9572 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.office.com
outlook.office365.com
outlook.cloud.microsoft
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
desktop-hsgcbep._dosvc._tcp.local
250.255.255.239.in-addr.arpa
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D

Dropped files

C:\Users\analyst\AppData\Local\SumatraPDF\sumatrapdfcache\14872d47fb4c25fd1a9439d1298721fc.png - 54e97313a8c28cd61e7cd17e9ef7b5a3b5b336c4862400b6ff534169a1917fdc
C:\Users\analyst\AppData\Local\SumatraPDF\SumatraPDF-settings.txt - a502a89155fd5c44bc57fe11e97f8486ba081cdb8b482cbea72f99860f9b40d5
root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

http://netcdn.tw/app/431946152/free-robux-kid-friendly-game-hack
http://library.futureuniversity.com/repository/how-to-get-robux-for-free-2021_GM431946152.pdf
http://library.futureuniversity.com/repository/coin-master-free-link-app_GM406889139.pdf
http://library.futureuniversity.com/repository/roblox-robux-hack-youtube_GM431946152.pdf
http://library.futureuniversity.com/repository/coin-master-time-speed-hack_GM406889139.pdf
http://library.futureuniversity.com/repository/roblox-get-free-robux-online_GM431946152.pdf
http://library.futureuniversity.com/repository/roblox-geld-cheaten_GM431946152.pdf
http://library.futureuniversity.com/repository/glitches-for-free-hair-roblox_GM431946152.pdf
http://library.futureuniversity.com/repository/roblox-cheat-engine-mac-download_GM431946152.pdf
http://library.futureuniversity.com/repository/roblox-make-shirt-free_GM431946152.pdf
http://library.futureuniversity.com/repository/get-free-tiktok-followers-app_GM835599320.pdf
http://library.futureuniversity.com/repository/how-to-hack-bleach-soul-of-end-roblox_GM431946152.pdf
http://library.futureuniversity.com/repository/roblox-free-robux-game-guardian_GM431946152.pdf
http://library.futureuniversity.com/repository/free-promo-codes-for-robux_GM431946152.pdf
http://library.futureuniversity.com/repository/roblox-hack-ga_GM431946152.pdf
http://library.futureuniversity.com/repository/how-to-get-free-clothes-on-roblox_GM431946152.pdf
http://library.futureuniversity.com/repository/free-coin-and-spin-in-coin-master_GM406889139.pdf
http://library.futureuniversity.com/repository/how-to-get-free-robux-without-human-verification-2021_GM431946152.pdf
http://library.futureuniversity.com/repository/how-to-hack-roblox-fort-albreta_GM431946152.pdf
http://library.futureuniversity.com/repository/claim-free-robux-roblox_GM431946152.pdf
http://library.futureuniversity.com/repository/coin-master-100-spin-slot_GM406889139.pdf
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

netcdn.tw
library.futureuniversity.com

Embedded IP addresses

138.201.132.148
20.50.201.200
149.154.167.99
74.178.76.128
172.172.255.218
20.42.73.27
4.150.223.113
20.247.184.197
4.230.171.124
172.215.188.225
135.232.92.137
135.233.95.135
20.76.201.171
4.150.223.112
72.145.35.105
203.26.79.13
172.178.240.162
52.123.252.193
74.178.76.44
51.132.193.104
48.192.143.121
52.148.114.188

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report