MALICIOUS — 5737881.pdf

MALICIOUS — 5737881.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 000af30c6b724e23d23a973d0744ffcbc325abebc5d0462cbf5b1195bcff26bc
SHA-1: 9bf2a36df6b560c0dcdaec1a26b1db73df2db54b
MD5: 67a6578899e974ac79e360e4a4409ad8
ssdeep: 1536:vP2Ncobf1ucBnjjEIJtGl6fDTKTyznpaoEC/aXaKx5bN0UKAcIw3Vl+aTd:nebgsfEOtU6fDmTcL/8xNN/KAcIY0g
TLSH: T16137D0F36187ED5C775DDB07ACEB6528658AC78820219A9064C8BB4C847C6FF7D21B20
Submitted as: 5737881.pdf
File type: pdf · Size: 71544 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!67A6578899E9
Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4485457/normal_5ffa69417b64c.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://baarspo.ru/wb?keyword=car%20spare%20parts%20name%20and%20picture%20pdf, https://cdn.sqhk.co/fujigugi/YihP9SM/28680717646.pdf, https://guxojifupu.weebly.com/uploads/1/3/1/4/131438233/315a38d80aff07.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://baarspo.ru/wb?keyword=car%20spare%20parts%20name%20and%20picture%20pdf
https://cdn.sqhk.co/fujigugi/YihP9SM/28680717646.pdf
https://guxojifupu.weebly.com/uploads/1/3/1/4/131438233/315a38d80aff07.pdf
http://7gusevshop.space/ice_cream_runtzjnqn5.pdf
http://raicen.com/pajonupuxibisuzenife2urdj.pdf
http://shtampshop.ru/idle_shopping_mall_levels9fp2s.pdf
http://znakomstva69.space/50162329240gltz2.pdf
https://static.s123-cdn-static.com/uploads/4485457/normal_5ffa69417b64c.pdf
https://runumoviw.weebly.com/uploads/1/3/4/8/134854062/1027652.pdf
https://kololeranazi.weebly.com/uploads/1/3/4/5/134583506/2a114.pdf
https://lemapemoj.weebly.com/uploads/1/3/4/0/134040436/wesokegitidafu.pdf
https://static.s123-cdn-static.com/uploads/4451021/normal_5fde3cad48bab.pdf
https://static.s123-cdn-static.com/uploads/4392207/normal_5fec6ac765ae1.pdf
http://pshcomonhere.xyz/accounts_receivable_process_flow_chartuj0eq.pdf
https://cdn.sqhk.co/panajevem/geTsQaV/snes9x_ex_android.pdf
https://cdn-cms.f-static.net/uploads/4476453/normal_601629cf41af3.pdf
https://cdn.sqhk.co/zofizitene/7RJohdC/sour_orange_trees_for_sale_in_florida.pdf
http://usersonlineguardingsettings.site/idle_heroes_private_server_seasonal_guide6putl.pdf
http://sosed.market/reliance_industries_annual_report_2020apg6o.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

baarspo.ru
cdn.sqhk.co
guxojifupu.weebly.com
7gusevshop.space
raicen.com
shtampshop.ru
znakomstva69.space
static.s123-cdn-static.com
runumoviw.weebly.com
kololeranazi.weebly.com
lemapemoj.weebly.com
pshcomonhere.xyz
cdn-cms.f-static.net
usersonlineguardingsettings.site
www.w3.org
purl.org
ns.adobe.com
sosed.market

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report