MALICIOUS — f1d680_4de0e128b6074d55beaf9c220edc9fd1.pdf

MALICIOUS — f1d680_4de0e128b6074d55beaf9c220edc9fd1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 62b0c1fa675e83d17dc747aa844ac1bb7e28634b44aee9b2fe201a220809512a
SHA-1: 7c5014a50fcdcf331f718a25a9883697c5b5d4ff
MD5: 0fb8acbbd648a27ab99c4f6a82776d8f
ssdeep: 1536:yxwa+TLaQL2hJCFujONu4YOyR2qHXi4jzUThj43Zhmc6xUiS:JRp8yNujZEU6WZA9xw
TLSH: T1F137CFF3108BDE9C3ADA4B437CB21534B1999689A372DB6444C47B2DC4BD27EBE40A50
Submitted as: f1d680_4de0e128b6074d55beaf9c220edc9fd1.pdf
File type: pdf · Size: 72942 bytes
Verdict: malicious (96/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!0FB8ACBBD648
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4492892/normal_5fc74b258d895.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://maypoin.ru/wix?keyword=food+for+thought+worksheet+answers, http://limixumijegaf.epizy.com/87594666153.pdf, https://static.s123-cdn-static.com/uploads/4492892/normal_5fc74b258d895.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://maypoin.ru/wix?keyword=food+for+thought+worksheet+answers
http://limixumijegaf.epizy.com/87594666153.pdf
https://static.s123-cdn-static.com/uploads/4492892/normal_5fc74b258d895.pdf
http://wixiziz.iblogger.org/32238062080.pdf
http://buxamojajowolos.rf.gd/asthma_inhaler_technique_guidelines.pdf
http://rezotu.xyz/perfect_gears_chennai_pvt_ltd3mazq.pdf
http://kosatalek.rf.gd/muvawerawevapuvewajula.pdf
https://static.s123-cdn-static.com/uploads/4403540/normal_6002a5860940f.pdf
https://static.s123-cdn-static.com/uploads/4417824/normal_5fcaecd5955d2.pdf
http://4gusevshop.space/fontspace_safe_sitey3q3v.pdf
http://xukitekebuza.epizy.com/fox_furry_template.pdf
http://damvglaz2.xyz/box_office_predictions_for_star_wars_93jfa8.pdf
http://zafufevede.iblogger.org/cakewalk_software_free_full_version.pdf
http://gudibetujem.iblogger.org/codashop_pro_versi_terbaru.pdf
http://kosinatatit.rf.gd/notafemupajeselex.pdf
https://s3.amazonaws.com/posufij/you_know_me_piano_sheet_music.pdf
http://com-login8.xyz/mukuduzie2xkr.pdf
http://zigubogujivo.epizy.com/37044130031.pdf
http://logusubunovad.22web.org/38810969181.pdf
http://bejutamukedus.epizy.com/assistir_globo_reporter_ao_vivo_pela_internet.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

maypoin.ru
limixumijegaf.epizy.com
static.s123-cdn-static.com
wixiziz.iblogger.org
rezotu.xyz
4gusevshop.space
xukitekebuza.epizy.com
damvglaz2.xyz
zafufevede.iblogger.org
gudibetujem.iblogger.org
s3.amazonaws.com
com-login8.xyz
zigubogujivo.epizy.com
logusubunovad.22web.org
bejutamukedus.epizy.com
www.w3.org
purl.org
ns.adobe.com
buxamojajowolos.rf.gd
kosatalek.rf.gd
kosinatatit.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report