MALICIOUS — lajoraken.pdf
MALICIOUS — lajoraken.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
66ef13355bb5be7bdec750600c3c36ffb929db19613f7c6863568f33142d6fef - SHA-1:
524ac8e22670e2f0332693d9117496cef745262d - MD5:
38fca4d6f4640748e0810cb1a38bf1f7 - ssdeep:
1536:alx/EQyiu2kCjeggPBciQEDo5d4+To4Ajb3CWLvRk3s0Vyng3WspOR26n:6/2akM8BJQEDw4oo4qT9v280AngmRJ - TLSH:
T10A38C0F330CBDC8C7A4E9B136AFE12A85049C7987122E7904598777C847D9BEAE00D61 - Submitted as: lajoraken.pdf
- File type: pdf · Size: 80206 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://geobigoni.it/userfiles/files/bafopupo.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: http://a-pro-peau.fr/userfiles/file/12006300800.pdf, http://dj-maily.com/uploads/pages/files/fewejojawilubiz.pdf, https://bitree.com/ckfinder/userfiles/files/nelibepejiribixedepan.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=strategic+management+and+competitive+advantage+concepts+and+cases+pdf
- http://a-pro-peau.fr/userfiles/file/12006300800.pdf
- http://dj-maily.com/uploads/pages/files/fewejojawilubiz.pdf
- https://bitree.com/ckfinder/userfiles/files/nelibepejiribixedepan.pdf
- https://adamant54.ru/userfiles/files/40205077306.pdf
- http://xnucleus.com/members/member_images/files/46627379448.pdf
- https://www.aaptuk.org/ckfinder/userfiles/files/jemakarutuxokiwumador.pdf
- http://deauville.ru/files/file/vojegaguvusaru.pdf
- http://geobigoni.it/userfiles/files/bafopupo.pdf
- http://abwjefferson.com/uploads/files/xofiwinaxelapadel.pdf
- http://bibliotekaludwin.pl/img/upload/files/lubakebasoku.pdf
- https://china-glass-mosaic.com/userfiles/files/20210907_064440.pdf
- https://akamercedes.com/images/uploads/files/fodatususamun.pdf
- http://realestatemiami.com/userfiles/files/101086583.pdf
- http://tootingtaxi.com/survey/userfiles/files/bubapemizunidosoxezorov.pdf
- http://schoonhovensvrouwenkoor.nl/ckfinder/userfiles/files/52439473288.pdf
- http://avvolodin.ru/upload/file/56923489936.pdf
- http://turchifiltri.com/userfiles/files/vezovexaj.pdf
- http://atenngo.com/admin/sites/site/documents/rekeli.pdf
- http://mu-rrrc.com/userfiles/file/kemimubevopixagaxinabupoj.pdf
- http://utcsp.rustyramone.com/uploads/files/nuwumukurasaduparuxi.pdf
- https://petroblend.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613813fdd57dc---37466815242.pdf
- http://dzirerealtors.com/uploads/xapexaxuso.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- feedproxy.google.com
- a-pro-peau.fr
- dj-maily.com
- bitree.com
- adamant54.ru
- xnucleus.com
- www.aaptuk.org
- deauville.ru
- geobigoni.it
- abwjefferson.com
- bibliotekaludwin.pl
- china-glass-mosaic.com
- akamercedes.com
- realestatemiami.com
- tootingtaxi.com
- schoonhovensvrouwenkoor.nl
- avvolodin.ru
- turchifiltri.com
- atenngo.com
- mu-rrrc.com
- utcsp.rustyramone.com
- petroblend.com
- dzirerealtors.com
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report