MALICIOUS — c351ae83.pdf

MALICIOUS — c351ae83.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5fa6d75c7567c5b022679882cd29e686395d9551e8071e2d59d9bd9350781a4a
SHA-1: edadf8a7abfc090198be15cbef080f7a0e40fa61
MD5: 5562fe7c3b168187873dfccbf7ba8094
ssdeep: 1536:f6BPWv0e03GxeO/+H2R4SydR3N4DjrgkfeSZtGjVvHftwLh:Cdve03h2R2dx4hmSZtgHftA
TLSH: T12637D0F72297CC8C29D66B47B9AB112D5486D25CB2325AA500C8BB3CC4BC6FDAD20D11
Submitted as: c351ae83.pdf
File type: pdf · Size: 72019 bytes
Verdict: malicious (96/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4489032/normal_5fcd6bd5f0e5c.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://gettraff.ru/wb?keyword=perfect%20shift%20mod%20apk%20android%201, https://uploads.strikinglycdn.com/files/2f40b48a-59f4-4d64-a65b-0f497fa9328c/introductory_physical_science_9th_edition_rae_answers.pdf, https://uploads.strikinglycdn.com/files/21045a4b-bf69-4901-993b-d5fec0024347/99536775824.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/wb?keyword=perfect%20shift%20mod%20apk%20android%201
https://uploads.strikinglycdn.com/files/2f40b48a-59f4-4d64-a65b-0f497fa9328c/introductory_physical_science_9th_edition_rae_answers.pdf
https://uploads.strikinglycdn.com/files/21045a4b-bf69-4901-993b-d5fec0024347/99536775824.pdf
https://static.s123-cdn-static.com/uploads/4489032/normal_5fcd6bd5f0e5c.pdf
https://cdn.sqhk.co/dupeguwova/hdfD03f/dokabikesiludodoxuta.pdf
https://bupaduzisi.weebly.com/uploads/1/3/4/4/134475958/326182.pdf
https://xegubivagemegi.weebly.com/uploads/1/3/4/4/134481439/2888916.pdf
https://cdn.sqhk.co/bozadukopufu/igZjhfn/next_bike_locations_stirling.pdf
https://mexupapomumag.weebly.com/uploads/1/3/0/7/130775103/moraxojarikifuk_toxukonok.pdf
https://cdn.sqhk.co/tubafejog/Figjhhd/prospect_united_methodist_church_maxton_nc.pdf
https://cdn-cms.f-static.net/uploads/4413242/normal_5f95a4d628cc3.pdf
https://cdn.sqhk.co/kozuvurop/hiia1x0/zosus.pdf
https://womomoko.weebly.com/uploads/1/3/4/8/134848640/7868964.pdf
https://panirosarukiza.weebly.com/uploads/1/3/4/1/134132539/delomur.pdf
https://xasigevas.weebly.com/uploads/1/3/4/5/134595911/nesazeg-sepokukij-lasovifizaje.pdf
https://powagaminabori.weebly.com/uploads/1/3/0/9/130969211/mukezorubepit.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

gettraff.ru
uploads.strikinglycdn.com
static.s123-cdn-static.com
cdn.sqhk.co
bupaduzisi.weebly.com
xegubivagemegi.weebly.com
mexupapomumag.weebly.com
cdn-cms.f-static.net
womomoko.weebly.com
panirosarukiza.weebly.com
xasigevas.weebly.com
powagaminabori.weebly.com
www.w3.org
purl.org
ns.adobe.com

File paths

u:\W+

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report