MALICIOUS — 4536232.pdf

MALICIOUS — 4536232.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 56b42bb089275d952f6de8841b19c0dcb6166c1bf7487f8e87d8d60bf0f002b1
• SHA-1: 660282eb99eb60a609df24532ad6e8aaba59ea6c
• MD5: 0d6d56c5d588cec0c3857772af9f3bb1
• ssdeep: 1536:syKkYAaB8VDWi6OtlKjm4roiATq6HRh0HNty/Wc5uXFpMd5:RPaKVt+jXc7TpRh0Hv/FY
• TLSH: T15235D0F37547ED98AF829353A66D540CA04EC1C87026DAA05845763ECDB827E7E20F61
• Submitted as: 4536232.pdf
• File type: pdf · Size: 59826 bytes
• Verdict: malicious (96/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://kupanonul.weebly.com/uploads/1/3/4/6/134682697/40a5e5.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://trafffe.ru/wb?keyword=pull%20bear%20app%20android, https://kupanonul.weebly.com/uploads/1/3/4/6/134682697/40a5e5.pdf, https://tekegalesi.weebly.com/uploads/1/3/0/7/130740489/f7cf3423.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffe.ru/wb?keyword=pull%20bear%20app%20android
• https://kupanonul.weebly.com/uploads/1/3/4/6/134682697/40a5e5.pdf
• https://s3.amazonaws.com/zasepo/43887129069.pdf
• https://tekegalesi.weebly.com/uploads/1/3/0/7/130740489/f7cf3423.pdf
• https://xapaxagi.weebly.com/uploads/1/3/4/5/134506746/zolotewu.pdf
• https://uploads.strikinglycdn.com/files/73ab9978-7f37-403b-94ee-318796229052/apk_for_showbox.pdf
• https://s3.amazonaws.com/mipeboro/amazon_card_generator_no_survey.pdf
• https://s3.amazonaws.com/mexavofezoxi/dslr_camera_logo.pdf
• https://kenediroxajomu.weebly.com/uploads/1/3/4/4/134440197/7271381.pdf
• https://cdn-cms.f-static.net/uploads/4391893/normal_5fbe2c9ad8e38.pdf
• https://cdn-cms.f-static.net/uploads/4375087/normal_5f8bb36f78f9b.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffe.ru
• kupanonul.weebly.com
• s3.amazonaws.com
• tekegalesi.weebly.com
• xapaxagi.weebly.com
• uploads.strikinglycdn.com
• kenediroxajomu.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report