MALICIOUS — bepetuz_durotu_vubol.pdf
MALICIOUS — bepetuz_durotu_vubol.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0d798f8605b4d983d2c5452bdeaa7d9ad192710010fdcbd4b8f0c828232235d6 - SHA-1:
f5f1bbf81b09dea52212a761b8bf4b7894903944 - MD5:
fed15805ffc4c35b61b25dfebad53abb - ssdeep:
1536:andZXxsDKWGPVQhyrNGeYYBcbWyQMmKdevBcmhgUIYRXl:mdZXNPy6YKcLmevYn - TLSH:
T1CC36CFF371A7ED6CB597A7936EE6182E748AD38830319B50449C7E6CD8BC1AE1C20D41 - Submitted as: bepetuz_durotu_vubol.pdf
- File type: pdf · Size: 69184 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/b52ea98c-ca3a-439d-920f-70f311eff004/60744268323.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://traffnew.ru/wb?keyword=coloring%20sheets%20free%20printables, https://uploads.strikinglycdn.com/files/b52ea98c-ca3a-439d-920f-70f311eff004/60744268323.pdf, https://uploads.strikinglycdn.com/files/cf28a146-a323-458c-8687-d5372fa41754/94971673827.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://traffnew.ru/wb?keyword=coloring%20sheets%20free%20printables
- https://uploads.strikinglycdn.com/files/b52ea98c-ca3a-439d-920f-70f311eff004/60744268323.pdf
- https://uploads.strikinglycdn.com/files/cf28a146-a323-458c-8687-d5372fa41754/94971673827.pdf
- https://static1.squarespace.com/static/5fc0012c12facd59cea80d2a/t/5fc171d74e98326c0246b7b8/1606513115499/static_equilibrium_calculations_lever.pdf
- https://static1.squarespace.com/static/5fc1c0b127a199023abb6e24/t/5fc78d3c1d106d256bc6349c/1606913340231/49521638437.pdf
- https://uploads.strikinglycdn.com/files/32aa3d29-195b-4d2f-9c2e-a456dc732d35/11779159907.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd3141a24c1c27cb530c81/1606234433933/coaching_agile_teams_lyssa_adkins_download.pdf
- https://uploads.strikinglycdn.com/files/dac5e827-599b-46a8-a7c0-18ace8d14f09/dikoxafujedawod.pdf
- https://s3.amazonaws.com/limewub/93921483000.pdf
- https://s3.amazonaws.com/jeromopelurab/acrobat_pro_xi_update.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe14443485235c868d0356/1606292550944/assist_the_citizens_of_haafingar.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0f06cc750a3b5a089f87/1606225672507/89317155833.pdf
- https://static1.squarespace.com/static/5fc6a7fce2fce462bcb40d5b/t/5fc86a3cec83506b0479c1ca/1606969918493/73601259227.pdf
- https://suzokixuvajix.weebly.com/uploads/1/3/0/7/130776208/0a7e33885bd3.pdf
- https://static1.squarespace.com/static/5fc0d12c3dfdd95b60d4a66f/t/5fc20c4d9d79364840d4d184/1606552655045/the_power_of_one_mastering_physics_answers.pdf
- https://xusawoji.weebly.com/uploads/1/3/0/7/130739635/zaxopamumini.pdf
- https://uploads.strikinglycdn.com/files/18333f73-9682-4abc-91a4-ab16d4ed4a08/mass_effect_annihilation_synopsis.pdf
- https://static1.squarespace.com/static/5fc17f7ea13a450babf85411/t/5fc56afd9ee0f32b870a5350/1606773503179/finral_black_clover_english_voice_actor.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- traffnew.ru
- uploads.strikinglycdn.com
- static1.squarespace.com
- s3.amazonaws.com
- suzokixuvajix.weebly.com
- xusawoji.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report