MALICIOUS — bcc0e4_5fe4bca86dc247ea9a5ff87061454b71.pdf

MALICIOUS — bcc0e4_5fe4bca86dc247ea9a5ff87061454b71.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 1ec1645b1b439499fcbb383ae21222a1d7728f9e581edb3fd58d479ffb0e6539
• SHA-1: 61416129de5b0409991f2d379d01aab11f757db9
• MD5: b29b40e365739c6dd790b3f47a57060b
• ssdeep: 1536:fD/uOwaoUH2kFClDCwXxM7zjHnEXRbpurfiqI+P3sXjgYfho1K7kZoP0Oc:dwaoUWkF0+wXxMzHEFsfiqAXjdtSoo
• TLSH: T12639E1F390E7CD4CBEA59717BEB51249F09AE78CA621566510CCB33CC8B825E2E25C41
• Submitted as: bcc0e4_5fe4bca86dc247ea9a5ff87061454b71.pdf
• File type: pdf · Size: 87971 bytes
• Verdict: malicious (96/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!B29B40E36573
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4450036/normal_5fe05227f34c0.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://xezojetit.ru/wix?keyword=pc+dmis+training+manual, https://static.s123-cdn-static.com/uploads/4450036/normal_5fe05227f34c0.pdf, http://ionatr.fun/bhagavan_saranam_bhagavathi_saranamnqyel.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://xezojetit.ru/wix?keyword=pc+dmis+training+manual
• https://static.s123-cdn-static.com/uploads/4450036/normal_5fe05227f34c0.pdf
• https://s3.amazonaws.com/wajibile/26404848334.pdf
• http://ionatr.fun/bhagavan_saranam_bhagavathi_saranamnqyel.pdf
• https://s3.amazonaws.com/litunux/bangla_movie_nabab_full_hd_free.pdf
• http://nicechange.space/stick_zombie_arena_49l65c.pdf
• https://cdn-cms.f-static.net/uploads/4471512/normal_6014d15481f37.pdf
• https://static.s123-cdn-static.com/uploads/4424632/normal_5ff5eb62c5afb.pdf
• https://nitevugumosu.weebly.com/uploads/1/3/4/5/134526644/razovekopidakarowali.pdf
• https://fodolirikixubug.weebly.com/uploads/1/3/5/2/135297927/5693547.pdf
• http://fikakoba.rf.gd/xasuwovusugagebebub.pdf
• https://s3.amazonaws.com/xipavir/12_million_black_voices_chapter_summary.pdf
• https://s3.amazonaws.com/tozaduliwubega/1_de_maio__feriado_na_inglaterra.pdf
• http://potefedezazox.rf.gd/l_algorithme_informatique_tronc_commun.pdf
• https://s3.amazonaws.com/pukaridimupo/29546491991.pdf
• http://rinobozawizuvew.iblogger.org/how_to_adjust_rheem_water_heater.pdf
• https://s3.amazonaws.com/sirilagewuga/premier_protein_whey_powder_reviews.pdf
• https://sobanuwutotamiw.weebly.com/uploads/1/3/4/1/134131644/tanapegalabegiwow.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• xezojetit.ru
• static.s123-cdn-static.com
• s3.amazonaws.com
• ionatr.fun
• nicechange.space
• cdn-cms.f-static.net
• nitevugumosu.weebly.com
• fodolirikixubug.weebly.com
• rinobozawizuvew.iblogger.org
• sobanuwutotamiw.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com
• fikakoba.rf.gd
• potefedezazox.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report