MALICIOUS — 66602202491.pdf
MALICIOUS — 66602202491.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
09e9026eaf1dec03f182e1efc46dc265bb612b2e37762506dbe0e319b6c9cb16 - SHA-1:
c7ab3f45bcac108f8d42f336f3fa3702852e0822 - MD5:
0465b60fca4da98290dc59fc2d1cfa6c - ssdeep:
768:4gGzpD/+o5UXVq20GvgKn8Xb09IMxA/ITYWJPX3jY/CrIFn:VGFD1UXVq20mUCA/ITYWpUKrIFn - TLSH:
T146329DF35057EE4C3D876743AEBB15986049E78931329660048CBA2CC5BC6FDBF05AA1 - Submitted as: 66602202491.pdf
- File type: pdf · Size: 44879 bytes
- Verdict: malicious (88/100)
Detections (3 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ggtraff.ru/strik?keyword=manual+de+horticultura+org%25C3%25A2nica+vi%25C3%25A7osa, https://uploads.strikinglycdn.com/files/b000ed1b-34af-4dbc-a5f2-3969377c5772/fufowuzonurikeduvofeveso.pdf, https://uploads.strikinglycdn.com/files/362bb963-ed36-4e32-a602-998b23691197/58192530862.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
1126 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- s.symcb.com
- rb.symcd.com
- rb.symcb.com
- searchapp.bundleassets.example
- inference.location.live.net
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- x2.c.lencr.org
- ye.c.lencr.org
- staging.to-do.officeppe.com
- yr.c.lencr.org
- m365.cloud.microsoft
- ntp.ubuntu.com
- 192.168.122.112
- 224.0.0.252
- 192.168.122.255
- 192.168.122.1
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://ggtraff.ru/strik?keyword=manual+de+horticultura+org%25C3%25A2nica+vi%25C3%25A7osa
- https://uploads.strikinglycdn.com/files/b000ed1b-34af-4dbc-a5f2-3969377c5772/fufowuzonurikeduvofeveso.pdf
- https://uploads.strikinglycdn.com/files/362bb963-ed36-4e32-a602-998b23691197/58192530862.pdf
- https://uploads.strikinglycdn.com/files/83f64e4b-73cf-428f-91d4-8d86039c1dd6/jodibotofotapawemexisim.pdf
- https://uploads.strikinglycdn.com/files/8dc0c6e6-a1cd-4e00-ba8b-842dac74e5e3/73380642952.pdf
- http://mumojo.behindthescenesinfirstgrade.com/uploads/1/3/1/4/131406390/4b9c7b0d.pdf
- https://uploads.strikinglycdn.com/files/ccfab18d-80de-48e6-86fe-c41b455711b2/95453524936.pdf
- https://uploads.strikinglycdn.com/files/363cb0b2-81d1-4db5-9b7b-24113177f8bb/liviwavupivareje.pdf
- https://uploads.strikinglycdn.com/files/2105845e-96c3-48ee-90f3-69d4a8c15c11/pozavirizelolivosedawim.pdf
- https://uploads.strikinglycdn.com/files/96c135f9-222e-4fc5-a27b-b681094b29f2/bidufiluxavapesexel.pdf
- https://uploads.strikinglycdn.com/files/01b46be8-6b66-4745-bb2a-5fa7334266bf/golaboguwuxumixutipuber.pdf
- https://cdn.shopify.com/s/files/1/0481/1046/9283/files/remelososuderek.pdf
- https://cdn.shopify.com/s/files/1/0430/0632/8985/files/game_of_thrones_torrent.pdf
- https://cdn.shopify.com/s/files/1/0437/2434/1400/files/74425006242.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- mumojo.behindthescenesinfirstgrade.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report