MALICIOUS — 55373979731.pdf

MALICIOUS — 55373979731.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 2d61c0e2c4125f44dbaabcdc690e52de38cadce6807c7ceff467e266c643a8f7
• SHA-1: b96e63a5b3e5dbdd5296a02995c7e1a698e69acc
• MD5: fca3896e23527ef19e3fadbe41565cda
• ssdeep: 1536:sku/i6vLAa8hC5pxRBdrufSEThirWCTN4pzhTYRlSA34HmnPv0qplWM:oRDAauAHgKrW/FKNZP8qpD
• TLSH: T16B38D0F35267DE4E3B9B874379A73159A58EC3CE7136A6604488B36C847C23E3E10660
• Submitted as: 55373979731.pdf
• File type: pdf · Size: 77072 bytes
• Verdict: malicious (94/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!FCA3896E2352
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_e4c6071b2b314281a6b5ecd271eb878d.pdf?index=true - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://soxebez.ru/strik?utm_term=what+did+vanya+do+in+umbrella+academy, http://pixell.store/the_secret_life_of_walter_mitty_streamingp8484.pdf, https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_e4c6071b2b314281a6b5ecd271eb878d.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://soxebez.ru/strik?utm_term=what+did+vanya+do+in+umbrella+academy
• http://pixell.store/the_secret_life_of_walter_mitty_streamingp8484.pdf
• https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_e4c6071b2b314281a6b5ecd271eb878d.pdf?index=true
• https://s3.amazonaws.com/rurovikejigibu/racing_car_games_for_pc_free.pdf
• http://bodagimama.iblogger.org/45894736852.pdf
• https://4f0f5a39-0a2f-4cdf-b4e4-40a644fad8b9.filesusr.com/ugd/2024fe_fab15a6bb6d94e80b9187e48bcdd3bff.pdf?index=true
• http://vpntop.info/xuromamokazudakib9oqyd.pdf
• https://b7953657-6b45-4ea9-9d9d-f701e3f26526.filesusr.com/ugd/45996c_293da4c79140448f85852a11b0170169.pdf?index=true
• http://zujakogi.onlinewebshop.net/21208372935.pdf
• https://3c3b6f52-20a2-448a-be11-eec5930c502f.filesusr.com/ugd/0ca786_a2eea6e63edd47a3bec2eeffcf43f83a.pdf?index=true
• http://mitazaxajawusef.22web.org/12759572454.pdf
• http://blog-millionaire.buzz/wizudijarerezijemagufijmkvs6.pdf
• http://bamimutekinawaz.22web.org/best_sheet_masks_for_anti_aging.pdf
• http://vijofogozorumi.22web.org/personal_statement_for_university_application.pdf
• https://s3.amazonaws.com/loxopudizus/xewawibi.pdf
• http://mojigoka.atwebpages.com/64806387652.pdf
• http://varnisvakq.ru/funny_question_and_answer_pick_up_lineso9jfd.pdf
• https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_8379611dd8b34119b6929c507f5199b4.pdf?index=true
• http://mexuzekinukogip.iblogger.org/how_to_become_a_certified_eyelash_extension_trainer.pdf
• https://s3.amazonaws.com/gagagakigibapo/14391841256.pdf
• https://ac09d6fb-20d1-47e2-97cb-2568fc137cdf.filesusr.com/ugd/03dcd4_6303dcebd2774abd9426300232909b96.pdf?index=true
• https://b0cee159-9ce3-47d2-9452-de9e383f1b6b.filesusr.com/ugd/fac5c7_59bbfe35e13b481d9488362943fbb240.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/

Embedded domains

• soxebez.ru
• pixell.store
• 49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com
• s3.amazonaws.com
• bodagimama.iblogger.org
• 4f0f5a39-0a2f-4cdf-b4e4-40a644fad8b9.filesusr.com
• vpntop.info
• b7953657-6b45-4ea9-9d9d-f701e3f26526.filesusr.com
• zujakogi.onlinewebshop.net
• 3c3b6f52-20a2-448a-be11-eec5930c502f.filesusr.com
• mitazaxajawusef.22web.org
• bamimutekinawaz.22web.org
• vijofogozorumi.22web.org
• mojigoka.atwebpages.com
• varnisvakq.ru
• d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com
• mexuzekinukogip.iblogger.org
• ac09d6fb-20d1-47e2-97cb-2568fc137cdf.filesusr.com
• b0cee159-9ce3-47d2-9452-de9e383f1b6b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com
• blog-millionaire.buzz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report