MALICIOUS — 6b1ccf1519f18ea8fe9d91bafa9d08e69cf6dfae58a1a0430ab628f4fcdbb35b
MALICIOUS — 6b1ccf1519f18ea8fe9d91bafa9d08e69cf6dfae58a1a0430ab628f4fcdbb35b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6b1ccf1519f18ea8fe9d91bafa9d08e69cf6dfae58a1a0430ab628f4fcdbb35b - SHA-1:
24e595bca6d6cabff2cbf0734b0f632def4cbb91 - MD5:
c38a4ac573b2a196eed6c8b28e0ae884 - ssdeep:
1536:YttryP+1/atYZXdiIulZAtfws4qpgrFRRo1k9yxAz7EfbWRzLnFDFW3dHODpWcp9:YtuP+1StG7uzWU2oyYEf8vnZ+duDgmx - TLSH:
T1CA37C0F361E7DE8CB28E9F039DBB2164E48BD6CC51B2EA504088772C45BC97E6E10910 - Submitted as: 6b1ccf1519f18ea8fe9d91bafa9d08e69cf6dfae58a1a0430ab628f4fcdbb35b
- File type: pdf · Size: 75046 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://studiomanzetti.it/userfiles/files/dixenukupizotulegezeti.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: http://dalnoboy.org/data/filestorage/upload/files/sipana.pdf, http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/sfo6g4ksvmrhb85n1n7fh9udp2/61248451691.pdf, https://www.rogierstoel.nl/wp-content/plugins/super-forms/uploads/php/files/rc2htbldjnem17q4229svvni7l/92504563485.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=j7+prime+latest+firmware
- http://dalnoboy.org/data/filestorage/upload/files/sipana.pdf
- http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/sfo6g4ksvmrhb85n1n7fh9udp2/61248451691.pdf
- https://www.rogierstoel.nl/wp-content/plugins/super-forms/uploads/php/files/rc2htbldjnem17q4229svvni7l/92504563485.pdf
- http://begues.mobi/userfiles/file/wulazinufijenofadef.pdf
- http://sabaispa.net/userfiles/file/bulenuwuzibaf.pdf
- http://s8radziejowice-paszkow.pl/userfiles/file/kuralor.pdf
- http://technimexvn.com/images/ckeditor/files/72795167529.pdf
- http://studiomanzetti.it/userfiles/files/dixenukupizotulegezeti.pdf
- http://speed-r.com/js/upload/files/45504100817.pdf
- http://klinok-saintp.ru/files/disomowuvuzuxujomozakekow.pdf
- http://softtox.com/new/userfiles/file/suvadojefofo.pdf
- http://ozdesignhouse.com/app/webroot/uploads/files/48401876106.pdf
- http://crm333.com/documentos/file/xirakonigegevokexujobi.pdf
- https://dagvandearchitectuur.be/_files/file/kanotumenawenuletisunalo.pdf
- https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/eceom78lm1bsq2t1smh7q2anoc/93721947648.pdf
- http://volkshilfe-ktn.at/images/content/files/6934526729.pdf
- http://myshiou.com/uploads/files/202109071234417615.pdf
- http://dermatologomiguelgallego.com/miguel/fck/file/73551970308.pdf
- http://ustunongel.com/image/files/dafuzugubumogozivaxef.pdf
- http://oldadmin.k12cart.com/media/files/wirimowaladugapujo.pdf
- http://balie.overeembv-profielen.nl/upload/files/41355410594.pdf
- http://zanethompson.com/userfiles/file/xedugafopufi.pdf
- http://mimarathi.live/assets/ckfinder/core/connector/php/uploads/files/37916911068.pdf
- http://rqconsultores.com/userfiles/file/22364252083.pdf
Embedded domains
- feedproxy.google.com
- dalnoboy.org
- themultifold.com
- www.rogierstoel.nl
- begues.mobi
- sabaispa.net
- s8radziejowice-paszkow.pl
- technimexvn.com
- studiomanzetti.it
- speed-r.com
- klinok-saintp.ru
- softtox.com
- ozdesignhouse.com
- crm333.com
- dagvandearchitectuur.be
- cradlegold.com
- myshiou.com
- dermatologomiguelgallego.com
- ustunongel.com
- oldadmin.k12cart.com
- balie.overeembv-profielen.nl
- zanethompson.com
- mimarathi.live
- rqconsultores.com
- thegioichuyendong.info
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report