MALICIOUS — 8030276.pdf

MALICIOUS — 8030276.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 2ee440123c91d8eb8708548b0a0b3f1359c910e88243c2bc7edd6ecfe6207949
• SHA-1: 18d5310682cd51f04c1ed72f6990e103450a9e7c
• MD5: 8060f40e42787ec54afd456d428eef31
• ssdeep: 1536:MgmqYMaPPUjRrPCRyUBElSqTtO7O/PMsk/+SnvZ4lJfIz6bGOs6k:d0cF8b4SqTtfXwx47fS6pO
• TLSH: T10238E1F36293ED5CB7D7AB032DB2881A5047DB48B53295A41084762CC9BCAFE7D11E12
• Submitted as: 8030276.pdf
• File type: pdf · Size: 79021 bytes
• Verdict: malicious (94/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!8060F40E4278
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://roxagidu.weebly.com/uploads/1/3/4/7/134748987/vijekexagovoper_doxokufakotaxem.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://druttle.ru/wb?keyword=caa-%20gbg%20global%20brand%20management%20group, http://helpcopyright-service.com/togujefegatetutagozca.pdf, http://mini-cam1.club/classic_chess_games_pgn39hxa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://druttle.ru/wb?keyword=caa-%20gbg%20global%20brand%20management%20group
• http://helpcopyright-service.com/togujefegatetutagozca.pdf
• http://mini-cam1.club/classic_chess_games_pgn39hxa.pdf
• https://cdn.sqhk.co/luwukamuku/sQHjfgr/71439093117.pdf
• http://goodnatural.space/xapomidotorarepowejebemezns8s2.pdf
• http://dkblogin-de.com/road_racing_world_action_fund2gxh1.pdf
• https://roxagidu.weebly.com/uploads/1/3/4/7/134748987/vijekexagovoper_doxokufakotaxem.pdf
• https://s3.amazonaws.com/jinotugiwomo/online_accident_report_oregon.pdf
• http://alkim.xyz/30209952440gryqy.pdf
• https://rinavufapakoto.weebly.com/uploads/1/3/4/4/134460237/558933034bf4c.pdf
• https://gajifawegux.weebly.com/uploads/1/3/4/6/134649352/4053615.pdf
• http://help-bluebadgecustomer.com/bosidrtz8q.pdf
• http://prodson.fun/forifofevijavifutijvymjg.pdf
• https://cdn.sqhk.co/fedelubu/eidqii3/flying_swords_of_dragon_gate_2011_imdb.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• druttle.ru
• helpcopyright-service.com
• mini-cam1.club
• cdn.sqhk.co
• goodnatural.space
• dkblogin-de.com
• roxagidu.weebly.com
• s3.amazonaws.com
• alkim.xyz
• rinavufapakoto.weebly.com
• gajifawegux.weebly.com
• help-bluebadgecustomer.com
• prodson.fun
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report