MALICIOUS — normal_603279cbaf9b1.pdf

MALICIOUS — normal_603279cbaf9b1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 661f7ed1d3e29130b1c7c58d43979bdfe892fe331d95f09a62a91798fd3805d0
SHA-1: 05005999d0c0c721460c3ad21bb1b49501dc9105
MD5: 2d23ec8ba848ae89e2ca6f95dd45aa93
ssdeep: 1536:KthHqxvqTnlUmrFIJwgK8aDE/uarS/wjys2zQjhMKPRPRwHpiQWZuuXS:choeJDgZ/n7jCyBRw8Lup
TLSH: T11539D1F7915BCE8C6747971334B6A82D748FD7496622AFA540CCB2BCC43816E7E10990
Submitted as: normal_603279cbaf9b1.pdf
File type: pdf · Size: 87265 bytes
Verdict: malicious (96/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!2D23EC8BA848
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4454047/normal_5ff47a70848f0.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://yafferge.ru/123?utm_term=wing+chun+master+movie+2019, https://cdn-cms.f-static.net/uploads/4470552/normal_6014165d6bd51.pdf, https://migixemigesafo.weebly.com/uploads/1/3/1/3/131381985/mewajeweledofeluzo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://yafferge.ru/123?utm_term=wing+chun+master+movie+2019
https://cdn-cms.f-static.net/uploads/4470552/normal_6014165d6bd51.pdf
https://migixemigesafo.weebly.com/uploads/1/3/1/3/131381985/mewajeweledofeluzo.pdf
https://munulokepopat.weebly.com/uploads/1/3/5/2/135297381/levigudunakomi_puzagugun.pdf
http://pejulok.epizy.com/candy_camera_for_pc_windows_7.pdf
https://cdn-cms.f-static.net/uploads/4387419/normal_60110d6081d05.pdf
https://s3.amazonaws.com/fodose/vidmate_app_ko_karna_hai.pdf
http://xenuduximowub.epizy.com/c_form_telangana.pdf
http://xodenumaverap.epizy.com/guide_morgana_lol.pdf
https://static.s123-cdn-static.com/uploads/4454047/normal_5ff47a70848f0.pdf
https://static.s123-cdn-static.com/uploads/4416144/normal_5fc7971a36ed5.pdf
https://s3.amazonaws.com/babuxufarizuxur/calistenia_rutinas_y_ejercicios.pdf
https://viwekaxirudadax.weebly.com/uploads/1/3/4/7/134700275/mulekupuxuziboki.pdf
https://s3.amazonaws.com/gulapore/bangla_onubad_book.pdf
https://static.s123-cdn-static.com/uploads/4420592/normal_5ff661748b8b8.pdf
https://devarewiwigunum.weebly.com/uploads/1/3/2/7/132710712/6637535.pdf
http://juzatapanosuwi.rf.gd/54972090413.pdf
https://wafukereloxajof.weebly.com/uploads/1/3/5/3/135311523/jofor_gepilu_moviwiwuduko_pujarajajejixe.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

yafferge.ru
cdn-cms.f-static.net
migixemigesafo.weebly.com
munulokepopat.weebly.com
pejulok.epizy.com
s3.amazonaws.com
xenuduximowub.epizy.com
xodenumaverap.epizy.com
static.s123-cdn-static.com
viwekaxirudadax.weebly.com
devarewiwigunum.weebly.com
wafukereloxajof.weebly.com
nf.nl
www.w3.org
purl.org
ns.adobe.com
juzatapanosuwi.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report