MALICIOUS — muwozev.pdf
MALICIOUS — muwozev.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
29af349d01a1af08758dedc6384fb918fa686229dbd247ed4c3809d488ba79fc - SHA-1:
b10351d437acd4d39843b1c34476ab238b069063 - MD5:
af080f964f64748d8ab81e3f36cce7d7 - ssdeep:
1536:qmoZXHph4QAkVh+4DmpKRKphWVhlRRt5KOyIWApO6tuA:7AJh49kVkEmpoKpqLHKOyn6P - TLSH:
T14337BFF3618BCD5C774B9F8368FB119C6499E3885262E7800188B73CD1BC6BDAE54A41 - Submitted as: muwozev.pdf
- File type: pdf · Size: 71813 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://digitalpolicycouncil.com/imagenes/file/43676805620.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://sahodayabbsr.com/test/fckeditor/file/karofaduxekubukekorubar.pdf, http://gordostcrista.ru/userfiles/file/72778641106.pdf, http://sskj.pl/userfiles/file/55163944285.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=some+biological+terms
- https://sahodayabbsr.com/test/fckeditor/file/karofaduxekubukekorubar.pdf
- http://gordostcrista.ru/userfiles/file/72778641106.pdf
- http://sskj.pl/userfiles/file/55163944285.pdf
- http://lokalizacja-gps.pl/userfiles/file/geditixabebizej.pdf
- http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/16134516cee8ee---5938771207.pdf
- http://digitalpolicycouncil.com/imagenes/file/43676805620.pdf
- http://dongzzang.com/userfiles/file///1686981119.pdf
- http://studiocariola.com/userfiles/files/tugep.pdf
- http://barsugo.com/ckfinder/userfiles/files/jijipuxoju.pdf
- https://borsalino.ro/imagini_ws/75125796703.pdf
- http://shippingengineering.com/files/ckeditorothers/rapuvuduxozame.pdf
- https://history.tlshaa.org.tw/ckfinder/userfiles/files/90990728544.pdf
- http://avs-market.ru/admin/ckfinder/userfiles/files/dijowogobal.pdf
- http://studiocinti.eu/userfiles/files/53464127752.pdf
- https://stomatoloska-ordinacija-rijeka.com/files/totadewagedafi.pdf
- http://fizjoactiv.eu/Upload/file/fujilamafukeninunel.pdf
- http://kodemari.info/data/files/mokotadurubadojewegojug.pdf
- http://ediljolli.com/userfiles/files/31918885857.pdf
- http://www.ortodonciaelisafarache.com/ckfinder/userfiles/files/8782981126.pdf
- http://benthanhsgfarm.com/images/uploads/files/mewofareveraduzaxoxupokis.pdf
- https://nuevocoach.co.uk/wp-content/plugins/super-forms/uploads/php/files/0df79278e40956c900f72f925e8c3493/71934980311.pdf
- http://diysmart.net/userfiles/file/44147093363.pdf
- http://kssi.ir/public/userfiles/file/52530449278.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- feedproxy.google.com
- sahodayabbsr.com
- gordostcrista.ru
- sskj.pl
- lokalizacja-gps.pl
- www.studiolegalefusimorelli.com
- digitalpolicycouncil.com
- dongzzang.com
- studiocariola.com
- barsugo.com
- shippingengineering.com
- history.tlshaa.org.tw
- avs-market.ru
- studiocinti.eu
- stomatoloska-ordinacija-rijeka.com
- fizjoactiv.eu
- kodemari.info
- ediljolli.com
- www.ortodonciaelisafarache.com
- benthanhsgfarm.com
- nuevocoach.co.uk
- diysmart.net
- kssi.ir
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report