MALICIOUS — b27199_1564969e697a4535a75b5a6a522a33ee.pdf
MALICIOUS — b27199_1564969e697a4535a75b5a6a522a33ee.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
484f8a765a389d0f091f7d36b0913bb8383f4e1ca3ee860e83f9b7a334cdfd2c - SHA-1:
1200c4193462cd31fce0ae3a728a96125b4e69a6 - MD5:
4d736cd7a26ddf058cc531b9dcd27c46 - ssdeep:
1536:XhZBnkz97SmtNtH19WcJwFPQ/dvrtHHmHhWkU/Evgcbz9PgqK7AM4ndYf:x0z97SLyoQFvRnmHvU/Evgcf9gF7Atny - TLSH:
T14F39D0F3418FED8C6AC95F8739B7254C605A8A805472DEA05488B75CC57CBFE6F20A21 - Submitted as: b27199_1564969e697a4535a75b5a6a522a33ee.pdf
- File type: pdf · Size: 88457 bytes
- Verdict: malicious (94/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!4D736CD7A26D
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://urolog.xyz/konsep_psmba07e2k.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://yafferge.ru/wix?keyword=constant+rate+of+change+tables+worksheet, http://gagoxapedako.epizy.com/derivatives_of_sine_and_cosine_worksheet.pdf, http://mopasaz.epizy.com/elise_guide_8._24.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://yafferge.ru/wix?keyword=constant+rate+of+change+tables+worksheet
- http://gagoxapedako.epizy.com/derivatives_of_sine_and_cosine_worksheet.pdf
- http://mopasaz.epizy.com/elise_guide_8._24.pdf
- http://fojozefamofu.22web.org/bhairava_music_ringtone_free.pdf
- http://rakukoke.22web.org/rifipitujipusemurole.pdf
- http://managerprogram.live/tamil_jukebox_mp3_audiof9x7o.pdf
- http://woxagaxizi.22web.org/wifulejiwazevalo.pdf
- https://cdn.sqhk.co/vezubusevof/5Ehgfhi/tatirigopuju.pdf
- http://urolog.xyz/konsep_psmba07e2k.pdf
- http://vavijiguzedimeg.epizy.com/addition_maths_worksheets_year_1.pdf
- http://reduslim-siteofficial.site/black_lion_claim_ticket_scrapik3wi.pdf
- http://extrameets.fun/668701559014pc34.pdf
- http://tolevekup.epizy.com/45658422513.pdf
- http://getyourcredit.info/english_hd_movies_free_for_mobilehimtv.pdf
- http://artistichomesolutions.com/begubhbrwr.pdf
- http://jominata.rf.gd/asn1_editor_free.pdf
- http://detonic-official.website/how_to_see_my_blocked_phone_numbersdwu28.pdf
- http://lemiritafuwab.22web.org/49808347421.pdf
- https://cdn.sqhk.co/rotexopapi/fZibgjg/fogozalijupes.pdf
- http://tryadasert.online/rudomaxevolofoleze3ncg4.pdf
- http://wafibajew.epizy.com/36063960183.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- yafferge.ru
- gagoxapedako.epizy.com
- mopasaz.epizy.com
- fojozefamofu.22web.org
- rakukoke.22web.org
- managerprogram.live
- woxagaxizi.22web.org
- cdn.sqhk.co
- urolog.xyz
- vavijiguzedimeg.epizy.com
- reduslim-siteofficial.site
- extrameets.fun
- tolevekup.epizy.com
- getyourcredit.info
- artistichomesolutions.com
- lemiritafuwab.22web.org
- tryadasert.online
- wafibajew.epizy.com
- www.w3.org
- purl.org
- ns.adobe.com
- jominata.rf.gd
- detonic-official.website
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report