MALICIOUS — 0ddc0d78f6eb3f40b3097d498872d1af51f170ea8a60e020e4b79eb2715d174e
MALICIOUS — 0ddc0d78f6eb3f40b3097d498872d1af51f170ea8a60e020e4b79eb2715d174e is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0ddc0d78f6eb3f40b3097d498872d1af51f170ea8a60e020e4b79eb2715d174e - SHA-1:
a97ce35650c2d73cd85f5192273f89139cf8345f - MD5:
0774e60a8451f504abca220627f8286a - ssdeep:
1536:GAxG+W4mJJvmm77y7JETo9eJM+hrKh+jYMdjvUzGHKWWyA11ro:HxG+W4mjVwJSzh2h+8MdvUqqd6 - TLSH:
T14639C0F331D3DE4C758A9F43AAA71569758AC78C6132C7608188BB2CD07C27E7D64A11 - Submitted as: 0ddc0d78f6eb3f40b3097d498872d1af51f170ea8a60e020e4b79eb2715d174e
- File type: pdf · Size: 85200 bytes
- Verdict: malicious (96/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!0774E60A8451
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/c79f3010-c168-4cf7-a61a-01a799dc1a73/how_to_describe_a_beautiful_christmas_tree.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://infrive.ru/pbw?utm_term=picsart+hack+mod+download, https://uploads.strikinglycdn.com/files/c79f3010-c168-4cf7-a61a-01a799dc1a73/how_to_describe_a_beautiful_christmas_tree.pdf, http://jifesepapo.pbworks.com/w/file/fetch/144794577/guwilapevoxivovesaponi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://infrive.ru/pbw?utm_term=picsart+hack+mod+download
- https://uploads.strikinglycdn.com/files/c79f3010-c168-4cf7-a61a-01a799dc1a73/how_to_describe_a_beautiful_christmas_tree.pdf
- http://jifesepapo.pbworks.com/w/file/fetch/144794577/guwilapevoxivovesaponi.pdf
- http://fezosubi.pbworks.com/w/file/fetch/144780768/bayesian_statistics_the_fun_waydrive.pdf
- https://uploads.strikinglycdn.com/files/52da6a58-ae29-40fe-a2e5-4dcccca6d1a7/fotolupapolumeribikuvofe.pdf
- http://kepodaworo.pbworks.com/f/how_to_use_morphy_richards_microwave_convection_oven.pdf
- https://uploads.strikinglycdn.com/files/16c592cc-754b-4739-b545-3238d6258c31/how_to_change_battery_in_brk_670mbx_smoke_alarm.pdf
- http://jirofuwaso.pbworks.com/w/file/fetch/144740268/36312187752.pdf
- http://betifabito.pbworks.com/w/file/fetch/144921363/gizmo_evolution_mutation_and_selection.pdf
- http://juxivos.pbworks.com/f/lyse_palace_pronunciation.pdf
- https://uploads.strikinglycdn.com/files/1fdfe82a-0917-4353-9dd2-4c85c44fcd72/reparojitaregozi.pdf
- http://sojakun.pbworks.com/w/file/fetch/144734331/phoenix_force_vs_thanos.pdf
- http://mumubib.pbworks.com/w/file/fetch/144413301/82647769637.pdf
- https://uploads.strikinglycdn.com/files/8977717b-7fb1-4bf4-8031-0b4f1aa16213/my_maytag_dryer_wont_turn_on.pdf
- https://uploads.strikinglycdn.com/files/99f74ca2-0e96-4fda-a7b0-60a75deda9c8/88993227931.pdf
- http://muxopal.pbworks.com/w/file/fetch/144440808/26219192627.pdf
- http://xojifot.pbworks.com/w/file/fetch/144428934/bufugutoxetaki.pdf
- https://uploads.strikinglycdn.com/files/3c8101e7-dd99-46c5-bc11-d4a19ab84860/what_airline_is_qr.pdf
- https://xipazodi.weebly.com/uploads/1/3/4/3/134375507/renirizig.pdf
- https://xokapajutubesa.weebly.com/uploads/1/3/4/7/134730315/f3261b31.pdf
- http://gifavipa.pbworks.com/w/file/fetch/144698451/91932051775.pdf
- https://uploads.strikinglycdn.com/files/fe1d6604-ab66-49d6-9924-867f1860d20e/rozumazowidojoturominoto.pdf
- https://uploads.strikinglycdn.com/files/d4f06d24-1e7e-4831-8811-6ad72e7def87/9063074448.pdf
- https://sekowuwumobof.weebly.com/uploads/1/3/5/3/135394032/1563098.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- infrive.ru
- uploads.strikinglycdn.com
- jifesepapo.pbworks.com
- fezosubi.pbworks.com
- kepodaworo.pbworks.com
- jirofuwaso.pbworks.com
- betifabito.pbworks.com
- juxivos.pbworks.com
- sojakun.pbworks.com
- mumubib.pbworks.com
- muxopal.pbworks.com
- xojifot.pbworks.com
- xipazodi.weebly.com
- xokapajutubesa.weebly.com
- gifavipa.pbworks.com
- sekowuwumobof.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report