MALICIOUS — 4669129.pdf
MALICIOUS — 4669129.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
1efad713455258b1129059714ca5e5621af505a07f126e8269c91d5e14f20476 - SHA-1:
06e41e4874e9d1aacc62d8638c0d51f57f1fb86f - MD5:
668330c9e1739b84c5d25255149abb40 - ssdeep:
1536:cAkqOLLvh9g3CC5XHeJNmCsUVUmaR0d3rof:qqeL833x+vmCFUmd3I - TLSH:
T1DC36C0E72257DC8CB74ADB1768FB209D2599D78861329B10509CB36CC5AC26E3F70D12 - Submitted as: 4669129.pdf
- File type: pdf · Size: 65792 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!668330C9E173
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://vefenebef.weebly.com/uploads/1/3/4/8/134885139/b1b6282ebb13bf.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://druttle.ru/wb?keyword=rally%20racer%20cars%20racing, https://vefenebef.weebly.com/uploads/1/3/4/8/134885139/b1b6282ebb13bf.pdf, https://cdn.sqhk.co/pefatipi/pgghjhg/free_wifi_connect_internet_connection_find_hotspot.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://druttle.ru/wb?keyword=rally%20racer%20cars%20racing
- https://vefenebef.weebly.com/uploads/1/3/4/8/134885139/b1b6282ebb13bf.pdf
- https://cdn.sqhk.co/pefatipi/pgghjhg/free_wifi_connect_internet_connection_find_hotspot.pdf
- http://copyrightsupportforlnstagram.com/dummy_escape_literaturex1cd5.pdf
- https://cdn.sqhk.co/tiwumixe/eM1ihjc/93868313162.pdf
- https://cdn.sqhk.co/kebubupoxiz/ciajf4E/vodazodopumeroxowuwi.pdf
- https://cdn.sqhk.co/mikevoponage/3dggMuT/12070758008.pdf
- https://cdn.sqhk.co/vapezuwe/UQhjjxC/simple_photo_background_change_app_for_android.pdf
- https://cdn.sqhk.co/kinibemazoz/5jjBDHw/xupopaluwodufi.pdf
- https://cdn.sqhk.co/gokitoser/Empig5S/ivan_the_gorilla_tacoma.pdf
- https://cdn.sqhk.co/depivuni/cjjKmMZ/xakav.pdf
- http://hurleyshamburgers.com/70366769978k20kl.pdf
- http://universityru.fun/animal_coloring_pages_to_print_for_freeitu0f.pdf
- http://mnogoturov.com/smash_allegations_listwq0et.pdf
- https://cdn.sqhk.co/rufadexu/gv1bgeE/youtube_nursery_rhymes_songs_tamil.pdf
- https://cdn.sqhk.co/fajoliteve/hfMij3A/fatamirifetu.pdf
- https://duwiwobejul.weebly.com/uploads/1/3/2/7/132740292/1999e523c6.pdf
- https://wunurobi.weebly.com/uploads/1/3/4/8/134881210/9852313.pdf
- https://vogavowaxataner.weebly.com/uploads/1/3/4/2/134266619/zobaxovuwemogo.pdf
- https://vudeberas.weebly.com/uploads/1/3/3/9/133997553/3990905.pdf
- https://pamigewome.weebly.com/uploads/1/3/4/6/134631685/jidepuzamunoronewe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- druttle.ru
- vefenebef.weebly.com
- cdn.sqhk.co
- copyrightsupportforlnstagram.com
- hurleyshamburgers.com
- universityru.fun
- mnogoturov.com
- duwiwobejul.weebly.com
- wunurobi.weebly.com
- vogavowaxataner.weebly.com
- vudeberas.weebly.com
- pamigewome.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report