MALICIOUS — 7268573.pdf

MALICIOUS — 7268573.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0b8210d345299c72d85d6a9f891cc825049669b5382d705fe1ed6b9ce148f7f0
SHA-1: 5d9b4661787d5e552f0f7c4cb951c435c11567fe
MD5: 1f1e0d9a251b856b5dc7fed8c552ef1c
ssdeep: 1536:kVET+Vc74WIEYolqnW1JIVbgU/Y3h0noUvORI7ZGE16+9/uY:mfWipo4n5PYaGRCZGE1X9R
TLSH: T16436C0F36057CDCD669A6B932AAB426E71D68388357196F440C4BB6C887C27CBF10B41
Submitted as: 7268573.pdf
File type: pdf · Size: 66678 bytes
Verdict: malicious (96/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4414680/normal_5fc791f716823.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://traffnew.ru/wb?keyword=binomische%20formeln%20gleichungen%20bei%20textaufgaben, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe10b6f3de5e49b52bc6b8/1606291655173/5_4_practice_dividing_polynomials_with_work_form_k_answers.pdf, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1b31b24ece27e9146c9b/1606228785821/38732524246.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://traffnew.ru/wb?keyword=binomische%20formeln%20gleichungen%20bei%20textaufgaben
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe10b6f3de5e49b52bc6b8/1606291655173/5_4_practice_dividing_polynomials_with_work_form_k_answers.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1b31b24ece27e9146c9b/1606228785821/38732524246.pdf
https://static.s123-cdn-static.com/uploads/4414680/normal_5fc791f716823.pdf
https://xikosenazegan.weebly.com/uploads/1/3/0/7/130739601/vimikozopanuwubufi.pdf
https://jinuvavuvebox.weebly.com/uploads/1/3/4/6/134612635/f096cfe7996.pdf
https://s3.amazonaws.com/rimepusox/folipodunek.pdf
https://fedobakeruja.weebly.com/uploads/1/3/4/3/134367732/3783105.pdf
https://static1.squarespace.com/static/5fbfdb415687f52b6b7b2913/t/5fc26d2ae6d49a06bbe0fc2d/1606577453165/sea_snails_food.pdf
https://static1.squarespace.com/static/5fc0e464ab79f442f229936f/t/5fc3f5111972c46e3c1825cb/1606677778409/what_are_the_music_channels_for_direct_tv.pdf
https://zijavenokin.weebly.com/uploads/1/3/4/3/134315340/4821156.pdf
https://s3.amazonaws.com/falufusu/ugly_cat_and_pablo_book_report.pdf
https://s3.amazonaws.com/rekawexuretowo/bolacha_de_arroz_integral_informao_nutricional.pdf
https://cdn-cms.f-static.net/uploads/4404733/normal_5f93969db8e46.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

traffnew.ru
static1.squarespace.com
static.s123-cdn-static.com
xikosenazegan.weebly.com
jinuvavuvebox.weebly.com
s3.amazonaws.com
fedobakeruja.weebly.com
zijavenokin.weebly.com
cdn-cms.f-static.net
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report