MALICIOUS — 77a9b97bc27e0.pdf

MALICIOUS — 77a9b97bc27e0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 6 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 66904afc362964d5f40fe363212c4e5d926db2aae36500e055df0f6db6296f81
• SHA-1: 2ba14fbbac19a2d6924b87dd0ea430fb1b2372cd
• MD5: 372e6e150aba7218c60d2849b5cfd7ba
• ssdeep: 1536:l7Yn9U8sGyFmNuXqM1ciTWO5Yi3Y5RSUjTXBxCcX+0/VK3ZMDkJ7qF:BL5GAmNuVDWKOtsKxK3+Dki
• TLSH: T1E338D0F3209BDE8CBE9F9B536AAB199DA045CB85B223A7504484732CC47C2BE3F14551
• Submitted as: 77a9b97bc27e0.pdf
• File type: pdf · Size: 80697 bytes
• Verdict: malicious (94/100)

Detections (6 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!372E6E150ABA
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com/ugd/fafc38_7b8363d6f61d452e9e1ed853e5590de9.pdf?index=true - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: http://fukoxonezadanom.22web.org/63736018277.pdf, http://nupigit.22web.org/93802599732.pdf, https://16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com/ugd/fafc38_7b8363d6f61d452e9e1ed853e5590de9.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://feedproxy.google.com/~r/wb/ENAH/~3/bQ3nTxENlgE/wb?keyword=moto%20360%202nd%20gen%20not%20turning%20on
• http://fukoxonezadanom.22web.org/63736018277.pdf
• http://nupigit.22web.org/93802599732.pdf
• https://s3.amazonaws.com/zomuzigo/9960273980.pdf
• https://s3.amazonaws.com/nitidadufetenu/weber_spirit_e310_vs_e210.pdf
• https://16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com/ugd/fafc38_7b8363d6f61d452e9e1ed853e5590de9.pdf?index=true
• https://s3.amazonaws.com/vuliwisuwig/addition_and_subtraction_of_rational_numbers_worksheet.pdf
• http://gosaduzunake.myartsonline.com/80215743339.pdf
• https://s3.amazonaws.com/ravuxudibure/norton_anthology_of_drama_volume_2.pdf
• https://s3.amazonaws.com/jaxesabi/83345016667.pdf
• http://todobokamuda.22web.org/gulamirinejirowofoka.pdf
• https://s3.amazonaws.com/tobito/instruction_guide_citizenship_canada_minor.pdf
• http://xumugipetoje.epizy.com/aok_sachsen_bonusheft.pdf
• http://penobugixova.atwebpages.com/4_pics_1_word_level_235_answer_5_letters.pdf
• https://s3.amazonaws.com/nojemi/17863318335.pdf
• https://4328a374-8b5c-4134-9cef-e132ca5fc89d.filesusr.com/ugd/6732b1_e478a0158dcd44a9aa7911b5c8524d77.pdf?index=true
• http://xapaponagegite.22web.org/cien_aos_de_soledad_frase_inicial.pdf
• http://bizuzagewad.iblogger.org/smudge_brushes_photoshop.pdf
• https://s3.amazonaws.com/pavujiniz/difference_between_apa_and_mla_format_bibliography.pdf
• https://s3.amazonaws.com/bidemewufa/associated_press_style_guide_online.pdf
• https://4779f2f8-a33e-4327-9c78-21ee0bcf4620.filesusr.com/ugd/31bf02_38dfb4fe5cf44c278c5a077fbeb81f31.pdf?index=true
• https://05790d5e-93e9-4545-bcc4-99c37f081c18.filesusr.com/ugd/bff4d5_728408e09da9441ea7d4e00455e2c032.pdf?index=true
• http://liseravuziw.22web.org/19126872552.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• feedproxy.google.com
• fukoxonezadanom.22web.org
• nupigit.22web.org
• s3.amazonaws.com
• 16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com
• gosaduzunake.myartsonline.com
• todobokamuda.22web.org
• xumugipetoje.epizy.com
• penobugixova.atwebpages.com
• 4328a374-8b5c-4134-9cef-e132ca5fc89d.filesusr.com
• xapaponagegite.22web.org
• bizuzagewad.iblogger.org
• 4779f2f8-a33e-4327-9c78-21ee0bcf4620.filesusr.com
• 05790d5e-93e9-4545-bcc4-99c37f081c18.filesusr.com
• liseravuziw.22web.org
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report