MALICIOUS — normal_60418f2d0ee18.pdf
MALICIOUS — normal_60418f2d0ee18.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0af7a5d748c567cdd5b28b5e643bc8525f7c530d3a12be863f961404d7ebe930 - SHA-1:
b20d4e11a27bcabe84a62224b81615336b393218 - MD5:
88f5adef3fac1beaacbf5050a109e3cd - ssdeep:
1536:ONe2B6bMVYuLFVOj89Ykz0b3rUvUXCNZ9nnkjzksfmy4Na/tTG4JdpSYiH:N2B6sDLFEQ974bgvUyNbkjwsfmy4Q/tU - TLSH:
T14F38BFF7208BDE8C674B5793B8A612A5355AC74825329BB00184BB2CD9AC5FE3F10B51 - Submitted as: normal_60418f2d0ee18.pdf
- File type: pdf · Size: 79913 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!88F5ADEF3FAC
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://pixigakamorage.weebly.com/uploads/1/3/4/3/134351623/towelu.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://fokemale.ru/123?utm_term=centerpoint+rifle+scope+6-20x50mm+review, https://pixigakamorage.weebly.com/uploads/1/3/4/3/134351623/towelu.pdf, http://vatidenow.medianewsonline.com/56784845877.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://fokemale.ru/123?utm_term=centerpoint+rifle+scope+6-20x50mm+review
- https://pixigakamorage.weebly.com/uploads/1/3/4/3/134351623/towelu.pdf
- http://vatidenow.medianewsonline.com/56784845877.pdf
- https://uploads.strikinglycdn.com/files/58e4f03c-724a-4d4a-b4da-777990291f63/are_the_lord_of_the_rings_movies_on_disney_plus.pdf
- http://tigafik.mygamesonline.org/norolelawazulufo.pdf
- http://ighelperscenter.com/xukojafiripkeub.pdf
- http://keksik24.ru/apprendre_anglais_facile_pour_debutant26oo6.pdf
- http://my-credit.info/autocollimator_principley1sby.pdf
- https://uploads.strikinglycdn.com/files/5be4ed21-9f01-47d7-b961-919690a300a6/7_month_old_milestones_chart.pdf
- https://gemiletux.weebly.com/uploads/1/3/2/6/132681217/43b87d15d4952a.pdf
- http://front-glass.space/zenijozadepivesixudafiel6.pdf
- http://form-lnstagramverifiedbadges.com/jumper_cables_price_in_kenyam41rd.pdf
- https://uploads.strikinglycdn.com/files/98c4507f-85ad-4404-9e6b-3bacab65e2d8/45292534550.pdf
- https://gimuloge.weebly.com/uploads/1/3/0/7/130775506/9977823.pdf
- https://diwodineguxep.weebly.com/uploads/1/3/4/3/134305573/mikofola.pdf
- http://buwubaled.mywebcommunity.org/how_to_stop_casio_illuminator_from_beeping_every_hour.pdf
- http://supajiwa.myartsonline.com/kovegobo.pdf
- http://rakadan.sportsontheweb.net/sims_3_store.pdf
- http://f13x.xyz/8449126954400f5a.pdf
- https://nipituwosaxow.weebly.com/uploads/1/3/5/3/135312928/1426654.pdf
- https://uploads.strikinglycdn.com/files/1d032a02-5b1d-446c-a4ee-2cc35dcd5ed2/xetewevasavam.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- fokemale.ru
- pixigakamorage.weebly.com
- vatidenow.medianewsonline.com
- uploads.strikinglycdn.com
- tigafik.mygamesonline.org
- ighelperscenter.com
- keksik24.ru
- my-credit.info
- gemiletux.weebly.com
- front-glass.space
- form-lnstagramverifiedbadges.com
- gimuloge.weebly.com
- diwodineguxep.weebly.com
- buwubaled.mywebcommunity.org
- supajiwa.myartsonline.com
- rakadan.sportsontheweb.net
- f13x.xyz
- nipituwosaxow.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report