MALICIOUS — 74382925922.pdf
MALICIOUS — 74382925922.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
410aeec69fa3df35cab967790492ebb4149cf613a7714e6251a88b0f35a0d85c - SHA-1:
024be9ac064b6e14d91d7a2137cfc614bed33826 - MD5:
358613a575425d56a79d20ea521cd0ba - ssdeep:
1536:nmfyL6YdpqHX+iUI+3eicRrbxms4Qc9KvQkci7u/LSphdoWIQ8LXxzt8GW8pO74u:mjYfq3+E+38RbxKVKYkci7aLczX8LXdE - TLSH:
T1E338C0F31097DD9C774B8B0769FA1568A14EE7886023EA504048F79CD5BCABD7F04A90 - Submitted as: 74382925922.pdf
- File type: pdf · Size: 81109 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://kunjipsc.com/uploads/files/ranazefakedasa.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://mountainbrookbuilders.com/home/mountain/public_html/ckfinder/userfiles/files/xokagukitasow.pdf, https://bazab.ru/ckfinder/userfiles/files/zameda.pdf, https://juvelyrikoscentras.lt/Files/file/87246130934.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/6naE_Nh8_CY/uplcv?utm_term=camera+candy+apk
- https://mountainbrookbuilders.com/home/mountain/public_html/ckfinder/userfiles/files/xokagukitasow.pdf
- https://bazab.ru/ckfinder/userfiles/files/zameda.pdf
- https://juvelyrikoscentras.lt/Files/file/87246130934.pdf
- https://bestmiamiturf.com/wp-content/plugins/super-forms/uploads/php/files/5ba24d4d0c2c0500f92e44079035affd/77666265622.pdf
- https://www.studioline.ie/ckfinder/userfiles/files/50005533404.pdf
- https://www.capitalroofingct.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612f6a0f1da49---zewiw.pdf
- http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/eefo01v13hsuci5a1t4ivfrgog/52085580446.pdf
- https://voolabs.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612f0fd79bb49---98928143216.pdf
- https://avela.md/userfiles/file/zizinukibozezol.pdf
- http://kunjipsc.com/uploads/files/ranazefakedasa.pdf
- http://madurastones.com/userfiles/file/tubejopavewanevida.pdf
- http://hrdiborice.cz/erucom1/files/files/tenigejewoxasumel.pdf
- http://denge.aero/upload/files/bapagabar.pdf
- http://sgyscom.com/upload_fck/file/2021-9-11/20210911095708414120.pdf
- http://dishandspoonproductions.com/ckfinder/userfiles/files/78873080015.pdf
- http://bidmitt.com/img/files/file/kolujefeneriferox.pdf
- https://gtnet-engine.com/ckfinder/userfiles/files/72840005817.pdf
- https://drakbera.com/ckeditor/ckfinder/userfiles/files/92533146161.pdf
- https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1612f4d961f292---mumolizaxorimejegu.pdf
- https://gsm.company/ckfinder/userfiles/files/wodomikaxumuxapi.pdf
- http://puntolinea.org/userfiles/files/dumuwazozoxikenati.pdf
- https://parfumzone.ro/files/file/86456076495.pdf
- https://phase1acoustics.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c437f2c425---18883593416.pdf
- https://beaszemin.com/files/gokes.pdf
Embedded domains
- feedproxy.google.com
- mountainbrookbuilders.com
- bazab.ru
- bestmiamiturf.com
- www.capitalroofingct.com
- www.olympussverige.se
- voolabs.com
- kunjipsc.com
- madurastones.com
- sgyscom.com
- dishandspoonproductions.com
- bidmitt.com
- gtnet-engine.com
- drakbera.com
- aguiapromocional.com.br
- puntolinea.org
- phase1acoustics.com
- beaszemin.com
- thegioibaobicarton.com
- www.w3.org
- purl.org
- ns.adobe.com
- juvelyrikoscentras.lt
- www.studioline.ie
- avela.md
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report