MALICIOUS — used_life_fitness_cross_trainer_for_sale_uk.pdf
MALICIOUS — used_life_fitness_cross_trainer_for_sale_uk.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
45c98fd0c82c69d0a41543b9baa7b320a8c3ea8e2d451fc2d11a236d50c0c17f - SHA-1:
48be912e561838633a0ff6ead78586d8a079640c - MD5:
172faca03c961d44bdb7bd66fbe212db - ssdeep:
1536:M6LOb2o+HTJ2LJJcdpUiZcMBeeI98fMZGtEVOJA4LnAqKYx0hN9:jLOiomAjGJeM0z6MVOG4LA+x0B - TLSH:
T14537C0F36197DE8CB687AB5378AB589CB049EBC82135DB1114847B9DC8782BE7C20D50 - Submitted as: used_life_fitness_cross_trainer_for_sale_uk.pdf
- File type: pdf · Size: 75908 bytes
- Verdict: malicious (94/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!172FACA03C96
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_c314caaf97db436283b7feb164b5de0d.pdf?index=true - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://xajibur.ru/strik?utm_term=used+life+fitness+cross+trainer+for+sale+uk, https://cdn-cms.f-static.net/uploads/4444096/normal_5fd66eb5e0f2c.pdf, https://uploads.strikinglycdn.com/files/be237743-deed-4a4b-90ef-e27e5a34c1e7/xiruwidimupifexofetiwaz.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://xajibur.ru/strik?utm_term=used+life+fitness+cross+trainer+for+sale+uk
- https://cdn-cms.f-static.net/uploads/4444096/normal_5fd66eb5e0f2c.pdf
- https://uploads.strikinglycdn.com/files/be237743-deed-4a4b-90ef-e27e5a34c1e7/xiruwidimupifexofetiwaz.pdf
- https://uploads.strikinglycdn.com/files/7e9a15e3-65b3-49b0-9c2f-bc881d25a441/how_to_get_abs_quickly.pdf
- https://uploads.strikinglycdn.com/files/b1c6b4a2-3202-4a30-b461-8f23af4d5199/89987991737.pdf
- https://uploads.strikinglycdn.com/files/d70468e5-d464-4dd7-85ac-f2bc25918629/republic_of_doyle_season_3_episode_13_cast.pdf
- https://uploads.strikinglycdn.com/files/15e1e4d2-f974-4546-88b3-1dfde263f023/beliwukonigupejewim.pdf
- https://cdn.sqhk.co/merojuniv/idijic4/medicin_de_la_calidad_ambiental.pdf
- https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_c314caaf97db436283b7feb164b5de0d.pdf?index=true
- https://uploads.strikinglycdn.com/files/a8477c99-1a15-4708-b47f-28f18982db41/7194309698.pdf
- https://ff9dba89-6132-4485-99c2-ace8a2453124.filesusr.com/ugd/c3f59f_e5c7cb270d304a42901daaa2ee72eca4.pdf?index=true
- https://uploads.strikinglycdn.com/files/33530119-70d5-43dc-acce-241dc06d7ee6/austin_texas_sales_tax_2020.pdf
- https://uploads.strikinglycdn.com/files/7742c2d1-1f36-4d91-bdaf-48667b6c39ae/jekifixolegogaje.pdf
- https://cdn.sqhk.co/wedowetaso/hb1xzjc/fudegazezelolerol.pdf
- https://uploads.strikinglycdn.com/files/5556e8b9-0248-403e-935b-15ba88e358dc/how_do_you_clean_a_bunn_coffee_maker.pdf
- https://cdn-cms.f-static.net/uploads/4446260/normal_600a9da29421c.pdf
- https://cdn-cms.f-static.net/uploads/4373508/normal_5fe7d1d26cabd.pdf
- https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_37d4517ee89441e984d054e9b40eeedd.pdf?index=true
- https://cdn.sqhk.co/boxumiza/arTijig/power_rangers_legacy_wars_mod_apk_unlimited_everything.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- xajibur.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.sqhk.co
- 7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com
- ff9dba89-6132-4485-99c2-ace8a2453124.filesusr.com
- cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report