MALICIOUS — 15540.pdf

MALICIOUS — 15540.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 3ee31eab8d1edc13ad84eed912bc95526b4ff493f7f382e94981c48f61b13f7b
• SHA-1: 95e1ee9b27a999b2e6ae157edb96cf9b9ec656bd
• MD5: fb806a265965dbaf570b9e7024808025
• ssdeep: 1536:j2c0Br5SP9fkBx4yeAmQJuzSHFjo5ErYqKy1F4zPPO:MBrYP2Bx4Em6ue0E9Kk4zO
• TLSH: T16936D0F3A04BDDDCBAD4AB43A6EC150D604ED58A7433962108CC766CCD792AE2F60D51
• Submitted as: 15540.pdf
• File type: pdf · Size: 67834 bytes
• Verdict: malicious (96/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://siregudak.weebly.com/uploads/1/3/0/7/130738759/1d46bd153.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://traffmen.ru/wb?keyword=windows%20server%202016%20ed%20maps%20manager%20error, https://xarisoxetawekox.weebly.com/uploads/1/3/4/3/134399368/8e05e83e2ad05.pdf, https://uploads.strikinglycdn.com/files/b7a5f40e-0f24-4c5f-bdfc-586d0cfb6bc4/68862890879.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffmen.ru/wb?keyword=windows%20server%202016%20ed%20maps%20manager%20error
• https://s3.amazonaws.com/lotibabakuj/gmail_sign_in_page.pdf
• https://xarisoxetawekox.weebly.com/uploads/1/3/4/3/134399368/8e05e83e2ad05.pdf
• https://uploads.strikinglycdn.com/files/b7a5f40e-0f24-4c5f-bdfc-586d0cfb6bc4/68862890879.pdf
• https://static1.squarespace.com/static/5fc11355ab79f442f22aa123/t/5fc5f92df3de5e49b53300d5/1606809902413/7705760883.pdf
• https://kisuwirabavaruz.weebly.com/uploads/1/3/3/9/133999170/tuseve.pdf
• https://lomimasexoguxi.weebly.com/uploads/1/3/4/7/134736135/vagibidebalosutuso.pdf
• https://cdn-cms.f-static.net/uploads/4366041/normal_5f8dd706365c1.pdf
• https://pirovosarelivo.weebly.com/uploads/1/3/1/4/131406751/dufetesolafa_bonedobovufov.pdf
• https://static1.squarespace.com/static/5fc0f7fbe9fc3622d5227cd2/t/5fc3b55461e25426e1a8edbc/1606661460861/95538846619.pdf
• https://s3.amazonaws.com/tevigotu/gesefop.pdf
• https://siregudak.weebly.com/uploads/1/3/0/7/130738759/1d46bd153.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• s3.amazonaws.com
• xarisoxetawekox.weebly.com
• uploads.strikinglycdn.com
• static1.squarespace.com
• kisuwirabavaruz.weebly.com
• lomimasexoguxi.weebly.com
• cdn-cms.f-static.net
• pirovosarelivo.weebly.com
• siregudak.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report