MALICIOUS — 3957515.pdf

MALICIOUS — 3957515.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 5aa9099cd1ac929da70d9b2c177bada767bc727fc9b83365226e25d54d113b8d
• SHA-1: 1528d1c49347e22660fee24efe1181f69b2fcd3e
• MD5: 1f59d6a34112aee395ef077d01648b42
• ssdeep: 1536:Y3qrPY2QKmmg6LP6fb/HD3Htji/5GwH2Xf49BRq5QmP461Y6ciHBUZl:iq02AmlP6D/r1U5Gwifeqr4P6ciHE
• TLSH: T15037D0F7A29BDD8CB756EF0329E7265DE446D68C6032836801847B2CC5783AF7E14960
• Submitted as: 3957515.pdf
• File type: pdf · Size: 73412 bytes
• Verdict: malicious (94/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!1F59D6A34112
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://komibaxes.weebly.com/uploads/1/3/1/6/131606619/rovutanugubuza_zisimew_mabusako.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://yafferge.ru/wb?keyword=hill%20climb%20truck%20racing%202%20download, http://nesobaka9.xyz/kajuligigodopomufovavugadtdhb3.pdf, https://komibaxes.weebly.com/uploads/1/3/1/6/131606619/rovutanugubuza_zisimew_mabusako.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://yafferge.ru/wb?keyword=hill%20climb%20truck%20racing%202%20download
• http://nesobaka9.xyz/kajuligigodopomufovavugadtdhb3.pdf
• https://komibaxes.weebly.com/uploads/1/3/1/6/131606619/rovutanugubuza_zisimew_mabusako.pdf
• http://stc-l.ru/xubebopenanetixlyxqa.pdf
• https://cdn.sqhk.co/naveropifo/cgcuYgh/27680512160.pdf
• http://help-violation.com/deruxagaloxm2yu.pdf
• http://kamaxunavag.epizy.com/ccpc_act.pdf
• https://cdn.sqhk.co/xexisini/Hxggijj/photo_vault_app_backup_android.pdf
• http://barcaporirternet-interbank-pe.com/gidapugizovizupozanojevaluoarv.pdf
• http://fallofelin.online/furovosisesezavadzd.pdf
• http://dezusuratadaf.rf.gd/pirate_hat_craft_template.pdf
• http://onlinetiser.website/doronomotetaderetuzami4yxdn.pdf
• http://1xbets-regs.site/doliluxiredidowafofidt6v2i.pdf
• https://lewuseloti.weebly.com/uploads/1/3/1/4/131437615/joxesex.pdf
• http://tazikuruwuwozu.22web.org/gamezunobepus.pdf
• http://getliterate.online/lajadipofokanozodomupgg9ar.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• yafferge.ru
• nesobaka9.xyz
• komibaxes.weebly.com
• stc-l.ru
• cdn.sqhk.co
• help-violation.com
• kamaxunavag.epizy.com
• barcaporirternet-interbank-pe.com
• fallofelin.online
• 1xbets-regs.site
• lewuseloti.weebly.com
• tazikuruwuwozu.22web.org
• getliterate.online
• www.w3.org
• purl.org
• ns.adobe.com
• dezusuratadaf.rf.gd
• onlinetiser.website

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report