MALICIOUS — 28503718888.pdf

MALICIOUS — 28503718888.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 024a5837668457d92398be853ea5326511d3a46166167cf584e21d6d8496b039
• SHA-1: c5434e5578edfe0d0fd64c46df78cffa53889f4f
• MD5: ba0a8414c6dd099ad648d29fa7d5a24a
• ssdeep: 1536:LGWDgrlK1dThh15lW8CDRByo4ttHo3czY5pYrJESITV6+5sBAYe:aWDgxW7lBsnyptHLY5OrtIBX5sBs
• TLSH: T10739D0F3618BCF4CAA9A6F83B975506CA449D3C8A123D6400488B76CD6BC6FD7F10961
• Submitted as: 28503718888.pdf
• File type: pdf · Size: 89945 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!BA0A8414C6DD
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://jottigo.ru/strik?utm_term=ejemplos+de+conclusiones+de+tesis+pdf, https://cdn.sqhk.co/lawafopugu/UAxYz8n/41646347662.pdf, https://cdn.sqhk.co/pilozarager/hhgdhcb/archer_hotel_new_york_rooftop.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://jottigo.ru/strik?utm_term=ejemplos+de+conclusiones+de+tesis+pdf
• https://s3.amazonaws.com/tozaduliwubega/what_is_the_healthiest_frozen_breakfast_sandwich.pdf
• https://s3.amazonaws.com/vebisop/electrical_estimation_and_costing_nptel.pdf
• https://s3.amazonaws.com/dalava/bodega_bay_fishing_weather_report.pdf
• https://s3.amazonaws.com/jipowumat/download_realtek_audio_driver_for_my_pc.pdf
• https://cdn.sqhk.co/lawafopugu/UAxYz8n/41646347662.pdf
• https://cdn.sqhk.co/pilozarager/hhgdhcb/archer_hotel_new_york_rooftop.pdf
• https://s3.amazonaws.com/mudurixo/lonurefix.pdf
• https://s3.amazonaws.com/xupizewuxere/hard_and_short_riddles_with_answers.pdf
• https://s3.amazonaws.com/bodajaku/37920544485.pdf
• https://s3.amazonaws.com/nuruvapozixix/compress_bitmap_to_jpeg_android.pdf
• https://s3.amazonaws.com/kavalukato/crossword_clue_answer_dark_brown.pdf
• http://debugor.iblogger.org/what_is_the_statute_of_limitations_on_assault_in_illinois.pdf
• https://cdn.sqhk.co/zenekukera/hhgwbge/beach_travel_bucket_list_2019.pdf
• http://vezerfa.xyz/4222472720911l2e.pdf
• https://s3.amazonaws.com/viwoxuz/mupixarusanujurubo.pdf
• http://themarkuzmusic.com/buku_belajar_sahamoqfii.pdf
• http://onlinesos.tech/79491744638luux3.pdf
• https://cdn.sqhk.co/sabepakofo/dihUPbP/rikajadetaditokexadobubit.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• jottigo.ru
• s3.amazonaws.com
• cdn.sqhk.co
• debugor.iblogger.org
• vezerfa.xyz
• themarkuzmusic.com
• onlinesos.tech
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report