MALICIOUS — fly-cheat-on-roblox_GM431946152.pdf

MALICIOUS — fly-cheat-on-roblox_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: a7c3da841f4cf8bd3b8f0f1ccabc43173dcbe82004b947856b4dfb9ce232cfc2
• SHA-1: 97b455f6ee24e3f5485ebce62660a6247ed79b92
• MD5: 29dab00b6cf1cde81ce7b848a68efcaa
• ssdeep: 1536:RcY9jJorEfRPzcR/dLHTu4EIIIIIIhY+x09JSrIP:Rc2jJorEfBzQ/dnIY+x0GY
• TLSH: T1D033ADF7528BDC4C7A8A4F8359FA112DE18ED3897131994091C8767CC07EABDAF20661
• Submitted as: fly-cheat-on-roblox_GM431946152.pdf
• File type: pdf · Size: 50072 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!29DAB00B6CF1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:PDF/Phish.CFN!MTB (rule Trojan:PDF/Phish.CFN!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.2 (rule PDF.Spam.Heur.2) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PDF/Phish-TWM!29DAB00B6CF1 (rule PDF/Phish-TWM!29DAB00B6CF1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://netcdn.tw/app/431946152/fly-cheat-on-roblox-game-hack, http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-hack-apk-35-33_GM406889139.pdf, http://perpustakaan.pn-tapaktuan.go.id/repository/hack-coin-master-app_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://netcdn.tw/app/431946152/fly-cheat-on-roblox-game-hack
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-hack-apk-35-33_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/hack-coin-master-app_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/haktuts-coin-master-free-spins_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-buy-robux-for-free_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-free-cards-link-2021_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-get-a-free-face-roblox_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-mod-version-free-download-v344_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/how-do-you-get-free-robux-without-paying_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-hack-spins-android_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-robux-for-kids-no-verification_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/gold-card-coin-master-free_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-get-free-spins-and-coins-in-coin-master_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/minecraft-hacked-client_GM479516143.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-robux-discord-servers_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/roblox-report-hacker_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/roblox-you-are-kicked-from-this-game-do-not-cheat_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-spins-coin-master-android_GM406889139.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/www-free-robux-com_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/free-robux-hack-us_GM431946152.pdf
• http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-hack-quora_GM406889139.pdf

Embedded domains

• netcdn.tw
• perpustakaan.pn-tapaktuan.go.id

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report