MALICIOUS — 351c84a3206f174a05d359c97af1782eaecc2f2aac2ba8d846fcad1647796ee6
MALICIOUS — 351c84a3206f174a05d359c97af1782eaecc2f2aac2ba8d846fcad1647796ee6 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
351c84a3206f174a05d359c97af1782eaecc2f2aac2ba8d846fcad1647796ee6 - SHA-1:
6a623f39b06c6e2e069e4ffb714afc39ce792560 - MD5:
0c3b417e96cd32e1059e7709c70c58d4 - ssdeep:
1536:Zy96I5Tl+Kws68ULGYdchqD/yChCFv+jMjn76Y5zLMpjFcfffSSE64gT4zCeYyqD:89FBus68QGc/1USQ7tMEHfsfgTveFqD - TLSH:
T11B38C0F351A7EC8C778E6B97B9B715AC649EC3845532D75000CCAA2C84EC7AD3E21906 - Submitted as: 351c84a3206f174a05d359c97af1782eaecc2f2aac2ba8d846fcad1647796ee6
- File type: pdf · Size: 80319 bytes
- Verdict: malicious (75/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!0C3B417E96CD
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4481282/normal_5fde41e360510.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://queure.ru/pbw?utm_term=nintendo+3ds+emulator, https://cdn-cms.f-static.net/uploads/4376600/normal_602795cde1e2a.pdf, https://static.s123-cdn-static.com/uploads/4481282/normal_5fde41e360510.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://queure.ru/pbw?utm_term=nintendo+3ds+emulator
- https://cdn-cms.f-static.net/uploads/4376600/normal_602795cde1e2a.pdf
- https://static.s123-cdn-static.com/uploads/4481282/normal_5fde41e360510.pdf
- https://dolumipekino.weebly.com/uploads/1/3/4/6/134625527/mobidubuvamemes_minigolofow_mutinajol.pdf
- https://bosazafaxaku.weebly.com/uploads/1/3/1/3/131383721/2736321b2f1b29d.pdf
- https://nikizatul.weebly.com/uploads/1/3/5/3/135309179/87914.pdf
- https://jasujidavoja.weebly.com/uploads/1/3/4/7/134770870/2e012c098.pdf
- https://cdn-cms.f-static.net/uploads/4451227/normal_5fe8f6e11e83a.pdf
- https://wadabugijiri.weebly.com/uploads/1/3/0/8/130873870/fubituxukari.pdf
- https://sazaburesifug.weebly.com/uploads/1/3/4/2/134265765/daxufigagiziva.pdf
- https://cdn-cms.f-static.net/uploads/4477155/normal_5fda31ab70286.pdf
- https://juliraviwuziw.weebly.com/uploads/1/3/4/2/134267057/5580484.pdf
- http://gifavipa.pbworks.com/f/cessna_172_illustrated_parts_catalog.pdf
- https://static.s123-cdn-static.com/uploads/4371509/normal_5fe4f644acc4f.pdf
- https://xikoxuzit.weebly.com/uploads/1/3/4/6/134632277/986099.pdf
- https://rapusixub.weebly.com/uploads/1/3/4/6/134631860/1aff8d30ac76.pdf
- https://cdn-cms.f-static.net/uploads/4459916/normal_6036747193a2f.pdf
- http://redelaw.pbworks.com/f/les_polygones_cm1_exercices_en_ligne.pdf
- http://naxenuve.pbworks.com/f/ingilizce_eitim_setleri.pdf
- https://static.s123-cdn-static.com/uploads/4502464/normal_60004195acdf4.pdf
- https://cdn-cms.f-static.net/uploads/4464852/normal_60b9aeca6ca39.pdf
- https://cdn-cms.f-static.net/uploads/4422180/normal_606c669d8237f.pdf
- https://cdn-cms.f-static.net/uploads/4382638/normal_603b04b6e5e86.pdf
- https://voxivunesiru.weebly.com/uploads/1/3/1/4/131407918/3bc3c440cf21b96.pdf
- http://fufitan.pbworks.com/f/ejercicios_aumentativos_diminutivos_y_despectivos_6o_primaria.pdf
Embedded domains
- queure.ru
- cdn-cms.f-static.net
- static.s123-cdn-static.com
- dolumipekino.weebly.com
- bosazafaxaku.weebly.com
- nikizatul.weebly.com
- jasujidavoja.weebly.com
- wadabugijiri.weebly.com
- sazaburesifug.weebly.com
- juliraviwuziw.weebly.com
- gifavipa.pbworks.com
- xikoxuzit.weebly.com
- rapusixub.weebly.com
- redelaw.pbworks.com
- naxenuve.pbworks.com
- voxivunesiru.weebly.com
- fufitan.pbworks.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report