MALICIOUS — 53934937073.pdf
MALICIOUS — 53934937073.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2d9a31b800ea156430a43859a13f8da912ae4f5ca553241045f074cad25503eb - SHA-1:
587e71be2726d8ad1cdb18438204bb5e30b987b8 - MD5:
5413aa7fec5bfa379f39b54bf8539f75 - ssdeep:
1536:hWb8+o8JisIdu7ZwrHRdrMp8t+EhZ9wHWMaP/472AAW6pOu2/Plfl7Kgb:sblRwsYu7Zmwetv3uwQxpu2/tNr - TLSH:
T1D638DFF360D7ED4DBB46DB432AAA11ACF046D688A172EC615088767CD4BC9FCBB10911 - Submitted as: 53934937073.pdf
- File type: pdf · Size: 78845 bytes
- Verdict: malicious (94/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://mariekevanvlierden.nl/survey/userfiles/files/83654201724.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://hkpefa.org/editor_upload/file/69350251432.pdf, https://perfecthospitals.org/FCKeditor/file/zefewofeg.pdf, https://bak.vn/upload/files/99255960770.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=money+heist+theme+song+mp4+download
- https://hkpefa.org/editor_upload/file/69350251432.pdf
- https://perfecthospitals.org/FCKeditor/file/zefewofeg.pdf
- https://bak.vn/upload/files/99255960770.pdf
- https://gjbuyerbroker.com/userfiles/file/53205461871.pdf
- http://fuyu.010bi.com/ckfinder/userfiles/files/91083086443.pdf
- http://phone-server.com/userfiles/file/relibujefowexago.pdf
- http://mariekevanvlierden.nl/survey/userfiles/files/83654201724.pdf
- https://teplitsyoptom.ru/wp-content/plugins/super-forms/uploads/php/files/7c62197533fca4bed2d99cfffecf8446/pakenedeta.pdf
- https://nhatngudongkinh.com/upload/ckupload/files/28511406354.pdf
- http://rsst77.ru/upload/files/xubajebibasuxefudizasipip.pdf
- http://crosswaysrecruitment.com/userfiles/file/55592409452.pdf
- https://anpheatingandac.com/nbloom/fckuploads/file/86795815371.pdf
- http://tid.vn/upload/files/49891236314.pdf
- http://architettomontanino.eu/userfiles/files/35246633172.pdf
- http://webinaris.blog/ckfinder/userfiles/publics/files/14196716644.pdf
- http://studioguagnoni.it/userfiles/files/39488925053.pdf
- http://alrehabourhome.com/userfiles/files/kizoxudididoturidel.pdf
- http://njxinbell.com/upload/files/wumutopupilulasazelenov.pdf
- http://ud2-140.com/files/6001651662.pdf
- http://tiszaikaland.hu/upload/file/ludaxo.pdf
- http://mallenmediations.com/mallenmediations/images/userfiles/file/zisowab.pdf
- http://pharmabiosolutions.com/filespath/files/20210910014817.pdf
- https://advik.net/userfiles/file/zimawof.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- feedproxy.google.com
- hkpefa.org
- perfecthospitals.org
- gjbuyerbroker.com
- fuyu.010bi.com
- phone-server.com
- mariekevanvlierden.nl
- teplitsyoptom.ru
- nhatngudongkinh.com
- rsst77.ru
- crosswaysrecruitment.com
- anpheatingandac.com
- architettomontanino.eu
- studioguagnoni.it
- alrehabourhome.com
- njxinbell.com
- ud2-140.com
- mallenmediations.com
- pharmabiosolutions.com
- advik.net
- www.w3.org
- purl.org
- ns.adobe.com
- bak.vn
- tid.vn
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report