MALICIOUS — lakeke.pdf
MALICIOUS — lakeke.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
254cf19c5bf2b238abbda6e1fa2b8f52bacb559f91a1b28ba48cac91c011cb69 - SHA-1:
c0d5b4b0b422b400b333536014e2a38daaa4d19e - MD5:
96948d074e9f84a93b012c50fd468ea3 - ssdeep:
1536:2ETeFl07HGt50OpXW/QrABRGXqIWJ0pGNvcWOpOwrKW7YoPngg/Ez+SHfbM:5TE0iDpXW/QrCRiqZ5wrNlhS/g - TLSH:
T17538D0F711CBDD8DB78A8B0339AA115DB0C9E3886162CB604089B67CA5BC6BD6F14C11 - Submitted as: lakeke.pdf
- File type: pdf · Size: 82736 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://insureavisitor.com/userfiles/file/nojib.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: http://insureavisitor.com/userfiles/file/nojib.pdf, http://t-p-fortune.com/userfiles/file/61600038907.pdf, http://kiuanai.com/userfiles/file/270134567.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=where+is+app+trash+on+android
- http://insureavisitor.com/userfiles/file/nojib.pdf
- http://t-p-fortune.com/userfiles/file/61600038907.pdf
- http://kiuanai.com/userfiles/file/270134567.pdf
- https://okazionche.com/files/rarisesubexi.pdf
- http://www.aunay-sous-auneau.fr/ckfinder/userfiles/files/fuxuwokepiwoxad.pdf
- http://www.liveartsaskatchewan.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613cc2597550e---legotimorexomet.pdf
- https://abril.pe/wp-content/plugins/super-forms/uploads/php/files/mui97uaqk1h3abgt4qivnf4d2i/41150348293.pdf
- http://www.herbertvanderbrugghen.nl/draft/50771386205.pdf
- http://letdentalab.com/img/files/60896843792.pdf
- http://csc0851.com/userfiles/file/20210906164919_k4tnyr.pdf
- https://noursportevents.com/wheelmarine/userfiles/file/rojusiligirob.pdf
- https://tinhhoaxanh.vn/userfiles/file/papefivemaw.pdf
- https://antoinepanau.com/wp-content/plugins/super-forms/uploads/php/files/560645dbb9ca8649a4cf70023150247b/xisemafupivadogej.pdf
- http://lifecontinues.ru/images/files/72532721176.pdf
- http://www.mousumibanerjee.com/fckimages/file/24382837352.pdf
- http://toshiteriyakiburien.com/uploads/files/powidovitavilaganetusunel.pdf
- http://bladensburg.abwingsmd.com/uploads/files/35496123708.pdf
- https://unitytradefze.com/ckfinder/userfiles/files/79408269052.pdf
- http://ctmmaximoravenna.com/ckfinder/userfiles/files/zuxagijufasamakakakuw.pdf
- http://gleb777.com/fck_upload/file/78053375616.pdf
- http://socialbomjesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/16140a177e4a8d---tofanovowo.pdf
- http://faurerom.com/userfiles/file/58393109979.pdf
- http://stroytehcentr.ru/images/file/sirafowekuwaminafibikux.pdf
- http://maivietnamesecotati.com/uploads/files/sunulew.pdf
Embedded domains
- feedproxy.google.com
- insureavisitor.com
- t-p-fortune.com
- kiuanai.com
- okazionche.com
- www.aunay-sous-auneau.fr
- www.liveartsaskatchewan.com
- www.herbertvanderbrugghen.nl
- letdentalab.com
- csc0851.com
- noursportevents.com
- antoinepanau.com
- lifecontinues.ru
- www.mousumibanerjee.com
- toshiteriyakiburien.com
- bladensburg.abwingsmd.com
- unitytradefze.com
- ctmmaximoravenna.com
- gleb777.com
- socialbomjesus.org.br
- faurerom.com
- stroytehcentr.ru
- maivietnamesecotati.com
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report