MALICIOUS — rupetalufekixetirikumum.pdf

MALICIOUS — rupetalufekixetirikumum.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 110178e42e3769793073c15829a860b7f047c20d25f50ca9ae8c00f30c669161
SHA-1: 4dab86b86e7856f8a44c91a6d681cccf048b72fc
MD5: 404499d2278887aecec96053d2ab508d
ssdeep: 1536:yKq956OWn18LYNDstDSqkiHktmfMiZ2bz9MPgqg9KcpH+glIAkHIPCa:vqrdWn18LYNYtDSqkiXflQ9UgnKcpH+k
TLSH: T13D39E0F3604BED8F39869B57BEF6449D744EDAC861338B94448CB6ACC86C16D3E60450
Submitted as: rupetalufekixetirikumum.pdf
File type: pdf · Size: 84541 bytes
Verdict: malicious (94/100)

Detections (6 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Microsoft Defender: flagged
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!404499D22788
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4380522/normal_602d97622365d.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://zajinet.ru/strik?utm_term=voyager+diana+gabaldon+large+paperback, https://uploads.strikinglycdn.com/files/0a34826e-a2fd-4d0e-9e9d-c9eb3d06e4f6/33051225850.pdf, https://cdn.sqhk.co/besewixogiv/cBY6dig/pdf_of_marketing_management_class_12.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

none

Embedded URLs

https://zajinet.ru/strik?utm_term=voyager+diana+gabaldon+large+paperback
https://uploads.strikinglycdn.com/files/0a34826e-a2fd-4d0e-9e9d-c9eb3d06e4f6/33051225850.pdf
https://cdn.sqhk.co/besewixogiv/cBY6dig/pdf_of_marketing_management_class_12.pdf
https://cdn-cms.f-static.net/uploads/4380522/normal_602d97622365d.pdf
https://cdn.sqhk.co/ninevowa/3Prugcu/wpf_datagridtemplatecolumn_celleditending.pdf
https://cdn.sqhk.co/tabakotodi/hhjg2hb/tozeduliniwub.pdf
https://uploads.strikinglycdn.com/files/c25b70d7-bb4c-44d8-9cf6-a09975e4ab9f/segimavagonuzu.pdf
https://cdn-cms.f-static.net/uploads/4418369/normal_602aec92941fc.pdf
https://static.s123-cdn-static.com/uploads/4382190/normal_5fde4fb6e5fbd.pdf
https://cdn-cms.f-static.net/uploads/4375194/normal_60401e35f0cae.pdf
https://cdn.sqhk.co/dewozoju/ejiRhan/head_basketball_mod_apk_download.pdf
https://cdn-cms.f-static.net/uploads/4383450/normal_6024a459d009a.pdf
https://cdn.sqhk.co/nuzinirumawe/hhfwLyy/5659972440.pdf
https://cdn-cms.f-static.net/uploads/4475565/normal_60493af839728.pdf
https://static.s123-cdn-static.com/uploads/4422893/normal_5fcf3e2819043.pdf
https://cdn.sqhk.co/zoxowowi/awPWhi0/does_texas_accept_electronic_proof_of_insurance.pdf
https://cdn.sqhk.co/puvelumilum/JhiihP2/13094061759.pdf
https://static.s123-cdn-static.com/uploads/4413017/normal_5fed9f24829f7.pdf
https://cdn-cms.f-static.net/uploads/4384628/normal_5fda7677035d7.pdf
https://cdn-cms.f-static.net/uploads/4409239/normal_603c59e7da9d8.pdf
https://cdn-cms.f-static.net/uploads/4391319/normal_60539d2530a2e.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

zajinet.ru
uploads.strikinglycdn.com
cdn.sqhk.co
cdn-cms.f-static.net
static.s123-cdn-static.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report