SUSPICIOUS — roblox-hack-com_GM431946152.pdf

SUSPICIOUS — roblox-hack-com_GM431946152.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: fc1b7032e8bcaf3d6718263eeb013ac55955bc01442682821edaee06ef3ed01e
• SHA-1: 3d60394646816f09eccb4058f54e4ba4277bb520
• MD5: 270388deeccfcf41b28c488ca0303bfb
• ssdeep: 768:tExXpzpBs/h7ezSsqZfXqRRLfad6ya56WpPlE1X7zQ9e6eBklXR92TekyvoSN0wZ:Mzpg7ezSsqZfXqRRLfad6yaTlEX7zkCC
• TLSH: T14C328DF7109BDD0C6A479B07A9FA60ADA4C5D78C7132CA5044D87B7CD0B85FEBA10922
• Submitted as: roblox-hack-com_GM431946152.pdf
• File type: pdf · Size: 43370 bytes
• Verdict: suspicious (44/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish.CFN!MTB
• Emsisoft (Emergency Kit): PDF.Spam.Heur.2
• Trellix Stinger (McAfee): PDF/Phish-TWM!270388DEECCF
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://netcdn.xyz/app/431946152/roblox-hack-com-game-hack, http://www.dhs.or.id/new/public/ckfinder/userfiles/files/get-free-coins-for-coin-master_GM406889139.pdf, http://dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-free-spin-ml_GM406889139.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://netcdn.xyz/app/431946152/roblox-hack-com-game-hack
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/get-free-coins-for-coin-master_GM406889139.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-free-spin-ml_GM406889139.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-no-verification_GM406889139.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/free-robux-com-2021_GM431946152.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-5-10-2021_GM406889139.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-daily-free-spins-link-app_GM406889139.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-without-downloading-apps_GM431946152.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/roblox-hack-download_GM431946152.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/minecraft-bedrock-client_GM479516143.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-8-14-2021_GM406889139.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/game-toolbox_GM479516143.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/legitimate-coin-master-free-spins-apk_GM406889139.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/robux-website_GM431946152.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-online-hack-2021_GM406889139.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/coin-master-hack-app_GM406889139.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/roblox-ban_GM431946152.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/free-links-coin-master_GM406889139.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/robux-best_GM431946152.pdf
• http://www.dhs.or.id/new/public/ckfinder/userfiles/files/how-can-i-get-free-robux_GM431946152.pdf
• http://dhs.or.id/new/public/ckfinder/userfiles/files/roblox-hackers-list_GM431946152.pdf

Embedded domains

• netcdn.xyz
• www.dhs.or.id
• dhs.or.id

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report