MALICIOUS — c31541c8cc53b.pdf

MALICIOUS — c31541c8cc53b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4adceb69cc25861df2305fd05a8ab5ae8d6963d192bced336a7e1dbec38c9ba0
SHA-1: 05036ac1e962cdba9c6682d768ba11f3097ceb06
MD5: 23dde421cdc2db937af3e160cac730e3
ssdeep: 1536:hmnyScd9b1NqQjjmDTrap+GE8su8sNfbefYrZixV1n9/oRc+903Xs:K1cd9b7qQejjGEGh7ZiJnqybM
TLSH: T19437E1F77283DD8D6AA54B537EEB101CA492C38D35746EA044C87A2CCD7C1BE6E64920
Submitted as: c31541c8cc53b.pdf
File type: pdf · Size: 71104 bytes
Verdict: malicious (96/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/7021a094-2ae8-42f1-b3c2-34a31fb2483a/battery_blueprint_factorio.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://traffnew.ru/wb?keyword=capsim%20guide%20pdf, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf603ec0a1d2b4e551716/1606219268114/35659768019.pdf, https://seperabe.weebly.com/uploads/1/3/4/7/134714478/30c5357.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://traffnew.ru/wb?keyword=capsim%20guide%20pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf603ec0a1d2b4e551716/1606219268114/35659768019.pdf
https://s3.amazonaws.com/rorives/ali_baba_chalis_chor_movie.pdf
https://seperabe.weebly.com/uploads/1/3/4/7/134714478/30c5357.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4bd4173fb5383b988b41/1606372309004/trio_pedal_manual.pdf
https://static1.squarespace.com/static/5fc306df2e537a05ef16faf6/t/5fc49626fa04221c71b1fd16/1606719016400/25335862703.pdf
https://s3.amazonaws.com/tixedujegibex/32783604028.pdf
https://cdn-cms.f-static.net/uploads/4366335/normal_5f944b493f1fb.pdf
https://static1.squarespace.com/static/5fc114532bbd74065807882e/t/5fc15e14f3de5e49b597b2a2/1606508052210/7205188646.pdf
https://static1.squarespace.com/static/5fc1262c084698658e5fcd88/t/5fc74530c953717e09d5e9a8/1606894896857/gijozuxekezasufiburaniru.pdf
https://uploads.strikinglycdn.com/files/7021a094-2ae8-42f1-b3c2-34a31fb2483a/battery_blueprint_factorio.pdf
https://uploads.strikinglycdn.com/files/2c749e89-ef83-462b-be0e-4d9b067c893d/zilivazigoneripozom.pdf
https://uploads.strikinglycdn.com/files/2384d11e-faed-468d-8b15-f6016c242447/resistivity_of_constantan_wire_lab_r.pdf
https://static1.squarespace.com/static/5fc2830cc30a162e0c5caa26/t/5fc7050356cd4459b3ae036b/1606878467879/fofax.pdf
https://cdn-cms.f-static.net/uploads/4368250/normal_5fa35fe999064.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

traffnew.ru
static1.squarespace.com
s3.amazonaws.com
seperabe.weebly.com
cdn-cms.f-static.net
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report