MALICIOUS — 8e9e2f_4d81b44b813a49528e187b672c77b5f5.pdf

MALICIOUS — 8e9e2f_4d81b44b813a49528e187b672c77b5f5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 60f3ef48004674da5086ac2d27f579f089b302d606bb27ba1e4214a9b1cb6c56
SHA-1: 8bdd9fc8643920b8f2f80311bca4ca1d7e79509e
MD5: 599ffeb53706064df5041f504a70df8f
ssdeep: 1536:ENh2LMFb2xeO/P2IKbx9oS/NUQfHYwrKeIvbafJO0CeRD368uOa8MmPdRJlaiHbi:E2YFqxeO//eNT4rbeZ68uOa/8DAi7EZ
TLSH: T1CA38D0F3614BED8C7ADA6B577C631079A48CE3886523CBD4804D7A5CC5ACAAE7F10841
Submitted as: 8e9e2f_4d81b44b813a49528e187b672c77b5f5.pdf
File type: pdf · Size: 78696 bytes
Verdict: malicious (96/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!599FFEB53706
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4383918/normal_5fdf2acd6d121.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://leonvi.ru/wix?keyword=anime+50%252F50+challenge+noble, https://static.s123-cdn-static.com/uploads/4383918/normal_5fdf2acd6d121.pdf, http://aycotoro6.xyz/ruzoziwunasuvezeji0m5wv.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://leonvi.ru/wix?keyword=anime+50%252F50+challenge+noble
https://static.s123-cdn-static.com/uploads/4383918/normal_5fdf2acd6d121.pdf
http://aycotoro6.xyz/ruzoziwunasuvezeji0m5wv.pdf
https://cdn-cms.f-static.net/uploads/4422392/normal_60282e5305ad4.pdf
https://s3.amazonaws.com/geraromu/gipunetosovibogeluti.pdf
https://static.s123-cdn-static.com/uploads/4408323/normal_5ffe46cc5fb10.pdf
http://poverkavoda.website/su_podium_v2.5_crackeadonxnwe.pdf
https://cdn-cms.f-static.net/uploads/4378404/normal_600e42d3f3fec.pdf
https://cdn.sqhk.co/tinupolureg/jkp3zjc/diy_golf_hitting_screen.pdf
https://cdn.sqhk.co/velizovatim/gd7gKhd/asphalt_8_apk_obb_5kapks.pdf
https://cdn-cms.f-static.net/uploads/4449984/normal_5fd87889c7556.pdf
https://cdn.sqhk.co/nobegasosev/gjhjZic/magic_hat_hocus_pocus.pdf
https://static.s123-cdn-static.com/uploads/4416653/normal_5ff88c35bc6cb.pdf
https://cdn.sqhk.co/wifukatar/hjiBjjm/.pdf
https://cdn-cms.f-static.net/uploads/4380545/normal_601342f59531f.pdf
https://static.s123-cdn-static.com/uploads/4476578/normal_5fcd8b1bb3b1c.pdf
https://cdn-cms.f-static.net/uploads/4402949/normal_601144e01ec5c.pdf
https://s3.amazonaws.com/bededuxotulapil/code_name_verity_book_review.pdf
http://krokoboko6.xyz/hamilton_zoo_classification_key_answers09k85.pdf
http://pro-komp-master.website/91028682283ixzyy.pdf
http://selectgetc.top/crosman_1077_spare_magazinellv1h.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

leonvi.ru
static.s123-cdn-static.com
aycotoro6.xyz
cdn-cms.f-static.net
s3.amazonaws.com
cdn.sqhk.co
krokoboko6.xyz
selectgetc.top
www.w3.org
purl.org
ns.adobe.com
poverkavoda.website
pro-komp-master.website

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report