MALICIOUS — 2a4f415ffd.pdf

MALICIOUS — 2a4f415ffd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 3c2967a78eb0dcf897ca54b94aa7d908a633fbb44eca110d4fe23c81416272f0
• SHA-1: 05da374dea7e5fccecfc8ddbec67fd35a0e971c4
• MD5: 1b9cf6b7f7dd849b4187a14cb8ec2abd
• ssdeep: 1536:5oqf/5vwXtdqQT9pjV9pdaOJsrq1hjGPjGUV4nOHyQ:Cqf5wxT9pkqOj9V4nOd
• TLSH: T13137D0F324CBDD8CB79A5757FAE714696456E2C8623395208184FF1CC5B87AE3C20A42
• Submitted as: 2a4f415ffd.pdf
• File type: pdf · Size: 71995 bytes
• Verdict: malicious (94/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc1b095ff13940aa2452ed8/t/5fcc30bb24c49707d31121cc/1607217340115/vaxezabet.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://trafficel.ru/wb?keyword=new%20frp%20bypass%20apk%202018, https://static1.squarespace.com/static/5fc1b095ff13940aa2452ed8/t/5fcc30bb24c49707d31121cc/1607217340115/vaxezabet.pdf, https://static1.squarespace.com/static/5fc578f6405d5340f3488c89/t/5fd60886034a586a4f39a466/1607862407769/standard_nuts_and_bolts_dimensions.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafficel.ru/wb?keyword=new%20frp%20bypass%20apk%202018
• https://static1.squarespace.com/static/5fc1b095ff13940aa2452ed8/t/5fcc30bb24c49707d31121cc/1607217340115/vaxezabet.pdf
• https://static1.squarespace.com/static/5fc578f6405d5340f3488c89/t/5fd60886034a586a4f39a466/1607862407769/standard_nuts_and_bolts_dimensions.pdf
• https://static1.squarespace.com/static/5fbffcc36609fd0ee78c2f31/t/5fc0e6074f9837572000c8fb/1606477327477/the_hot_and_cold_summer.pdf
• https://uploads.strikinglycdn.com/files/750da034-809f-402c-abe5-741be47007a1/deborah_harkness_shadow_of_night.pdf
• https://static1.squarespace.com/static/5fbffb1ae9fc3622d51d09b9/t/5fc1de9ebc819f1cf41cfa0b/1606540960590/64649252908.pdf
• https://static1.squarespace.com/static/5fc368e8c6229360ecbce8a9/t/5fd60648de5b1220c020c5dd/1607861832274/lowaxati.pdf
• https://static1.squarespace.com/static/5fc4c05eb8467722f1ec93c2/t/5fc6728bf3de5e49b5438ff2/1606840971714/anger_of_stick_4_apk_android_1.pdf
• https://s3.amazonaws.com/palikuvexake/lejoderigalukukedojit.pdf
• https://s3.amazonaws.com/jivuxo/kafefenokafupono.pdf
• https://s3.amazonaws.com/vuxalirudidel/zojofesesokavurun.pdf
• https://static1.squarespace.com/static/5fc0e155104edf1d7780ac3e/t/5fc2a1374e98326c02668a3a/1606590775959/brave_exvius_guide.pdf
• https://s3.amazonaws.com/tetenifeme/electromagnetic_induction_and_alternating_current_class_12_notes.pdf
• https://s3.amazonaws.com/meludav/viewanimator_in_android_studio.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafficel.ru
• static1.squarespace.com
• uploads.strikinglycdn.com
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report