MALICIOUS — 60059642089.pdf

MALICIOUS — 60059642089.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6a23406c4ecbad17484b23f24e31d43f5f917c485b8534d936e00e12492687b7
SHA-1: 0d706c7ed44ce0d29e1d06d686a343490a4b3221
MD5: 113d609da39398d4e54ea25fc4fdf089
ssdeep: 768:PgGzpDHHI+6qFr7m8jrNJP6fSod5Rwx8pXRkXzkcmqd1UCVWKgXdS:4GFDxRFrqSrQSZ8pXYIrkUg1gXdS
TLSH: T18A329EF35027ED8CA68F9F07AEE71058A14BC68D6132A76445887A3CC47C7FC2E44A61
Submitted as: 60059642089.pdf
File type: pdf · Size: 47266 bytes
Verdict: malicious (88/100)

Detections (3 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ggtraff.ru/strik?keyword=convert+pdf+to+word+acrobat, https://site-1037077.mozfiles.com/files/1037077/90330682971.pdf, https://site-1037157.mozfiles.com/files/1037157/15641944948.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1016 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/strik?keyword=convert+pdf+to+word+acrobat
https://site-1037077.mozfiles.com/files/1037077/90330682971.pdf
https://site-1037157.mozfiles.com/files/1037157/15641944948.pdf
https://site-1037121.mozfiles.com/files/1037121/lerizuno.pdf
https://site-1037279.mozfiles.com/files/1037279/datukusesitokagamajonep.pdf
http://popixe.soilandsun.co.uk/uploads/1/3/2/3/132303320/6088485.pdf
https://site-1037279.mozfiles.com/files/1037279/87302273651.pdf
https://site-1037160.mozfiles.com/files/1037160/jubalasobevugadibubaton.pdf
https://site-1037055.mozfiles.com/files/1037055/11420910837.pdf
https://site-1036767.mozfiles.com/files/1036767/58498672732.pdf
https://site-1036791.mozfiles.com/files/1036791/83597586048.pdf
http://nuvevowi.somoba.org/uploads/1/3/0/7/130776007/nirinamorekemag_winikilozuvama.pdf
http://files.matthewsflowerboutiquebloominbouquet.com/uploads/1/3/2/6/132681033/b0008e00dc.pdf
http://ronodiro.scotlycan.com/uploads/1/3/2/6/132681556/f3b42beff7.pdf
http://files.redwolfreview.info/uploads/1/3/2/3/132302859/datiwiwek.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ggtraff.ru
site-1037077.mozfiles.com
site-1037157.mozfiles.com
site-1037121.mozfiles.com
site-1037279.mozfiles.com
popixe.soilandsun.co.uk
site-1037160.mozfiles.com
site-1037055.mozfiles.com
site-1036767.mozfiles.com
site-1036791.mozfiles.com
nuvevowi.somoba.org
files.matthewsflowerboutiquebloominbouquet.com
ronodiro.scotlycan.com
files.redwolfreview.info
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report