MALICIOUS — 54dfea_d4148f63465f4e279311c7c00a0d6e60.pdf

MALICIOUS — 54dfea_d4148f63465f4e279311c7c00a0d6e60.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 149a29e762ae627e3840e033a44c02fef6a32ae18a60d60f8bbf438cc5fc59dc
SHA-1: e8cfab3f42ba58966447074cbe9157d753702694
MD5: 55e9996033613c1eb177d1aa840fd9bf
ssdeep: 1536:Z99vqxOc6HEOLWvwzPtfIqcOVmoTqbS0cWPgjHPCGMnm/UsttcY6ru0i3pNQ:Bvgn6HrWS/WkqbHgzazaUstCY6yo
TLSH: T17C37D1F351BBDD8CBA86D793BCE7487DA04DD7986522A7A048D8772D80AC2BD3D00950
Submitted as: 54dfea_d4148f63465f4e279311c7c00a0d6e60.pdf
File type: pdf · Size: 74752 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!55E999603361
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4481402/normal_6003416513799.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://jottigo.ru/wix?keyword=swo+fire+data, http://wulimazef.epizy.com/familias_de_hemiptera.pdf, https://static.s123-cdn-static.com/uploads/4481402/normal_6003416513799.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://jottigo.ru/wix?keyword=swo+fire+data
http://wulimazef.epizy.com/familias_de_hemiptera.pdf
https://static.s123-cdn-static.com/uploads/4481402/normal_6003416513799.pdf
http://tonagruz.ru/bezubaan_abcd.mp3_song_free_downloadtxlk9.pdf
https://static.s123-cdn-static.com/uploads/4443341/normal_5ffb4fcc66ef2.pdf
https://static.s123-cdn-static.com/uploads/4504047/normal_5fcbce517960e.pdf
http://semiwexojexudu.epizy.com/kairana_election_live_report.pdf
http://bisipatelaloguj.66ghz.com/sibejibew.pdf
https://cdn-cms.f-static.net/uploads/4412170/normal_60153f791f516.pdf
http://pochta-24.cc/224766335070aoir.pdf
https://nitegira.weebly.com/uploads/1/3/1/0/131071289/lovidi.pdf
http://bonapimum.iblogger.org/carlos_vives_la_gota_fria.pdf
http://cccckkkkkdd.space/kuduzasoptoekz.pdf
https://gojafone.weebly.com/uploads/1/3/4/8/134891791/728a0.pdf
http://sedouche.xyz/45507772857j9ky1.pdf
http://kinowazekuponaw.rf.gd/88231748249.pdf
https://static.s123-cdn-static.com/uploads/4475725/normal_600018014501f.pdf
https://webuwoterin.weebly.com/uploads/1/3/4/5/134589655/totopipamarezodi.pdf
http://pewusufep.epizy.com/ac_dc_tnt_album_free.pdf
http://emmetrix.net/bhowani_junction_full_moviekkwpq.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

hp7.gq
jottigo.ru
wulimazef.epizy.com
static.s123-cdn-static.com
tonagruz.ru
semiwexojexudu.epizy.com
bisipatelaloguj.66ghz.com
cdn-cms.f-static.net
pochta-24.cc
nitegira.weebly.com
bonapimum.iblogger.org
cccckkkkkdd.space
gojafone.weebly.com
sedouche.xyz
webuwoterin.weebly.com
pewusufep.epizy.com
emmetrix.net
www.w3.org
purl.org
ns.adobe.com
kinowazekuponaw.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report