MALICIOUS — 45016790798.pdf

MALICIOUS — 45016790798.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 0327fce34b2e9460e6b766834b023f7e0a5f0b40b56155cfd608e2221941a3c2
• SHA-1: 70e7652b51b4549d6495fdd517ab8991509afe9d
• MD5: e2a2714b1deb4d94b1990df78705c602
• ssdeep: 768:ngGzpDx2F/dq1C9y/x5gVCiBdrWLsQ0xxFu+RX:gGF90q13CBdK0u+RX
• TLSH: T191319DF34196DD883D875F8358A710982186D78972365A7459D9BF3CC8B82FCBF408A1
• Submitted as: 45016790798.pdf
• File type: pdf · Size: 39504 bytes
• Verdict: malicious (75/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 75/100 is the fusion of 4 weighted signals:

• Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/e2d9b55b-eb51-4fa5-8fd7-675c53f0626f/96587113394.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=claisen+condensation+reaction+pdf, https://uploads.strikinglycdn.com/files/eaef3e05-f5ec-435a-9fa3-d742354b477e/92875648867.pdf, https://uploads.strikinglycdn.com/files/c075d12a-a14d-472f-a905-df1e64a947e2/jeluralobevigegogalaj.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=claisen+condensation+reaction+pdf
• https://uploads.strikinglycdn.com/files/eaef3e05-f5ec-435a-9fa3-d742354b477e/92875648867.pdf
• https://uploads.strikinglycdn.com/files/c075d12a-a14d-472f-a905-df1e64a947e2/jeluralobevigegogalaj.pdf
• https://uploads.strikinglycdn.com/files/e2d9b55b-eb51-4fa5-8fd7-675c53f0626f/96587113394.pdf
• http://zikazoral.marioaceramemd.com/uploads/1/3/1/8/131871825/somokenetid.pdf
• http://lexajalob.apg-ga.com/uploads/1/3/1/0/131069910/7456448.pdf
• http://zagok.rayjoneswoodboxes.com/uploads/1/3/1/6/131607662/cf45fc54c04.pdf
• http://wubiv.lightsonfilm.com/uploads/1/3/1/3/131398234/fetutatat-poxubejufuruj.pdf
• http://files.drycreekgeneralstore1881.com/uploads/1/3/0/7/130739533/babejezapupov-duzegiretogu-zimopikazo.pdf
• http://riramuxus.lovinghotstuff.com/uploads/1/3/1/6/131606629/6913414.pdf
• http://files.hometechrenovations.ca/uploads/1/3/0/7/130739204/c165deed.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• uploads.strikinglycdn.com
• zikazoral.marioaceramemd.com
• lexajalob.apg-ga.com
• zagok.rayjoneswoodboxes.com
• wubiv.lightsonfilm.com
• files.drycreekgeneralstore1881.com
• riramuxus.lovinghotstuff.com
• files.hometechrenovations.ca
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report