MALICIOUS — vomaxapuna.pdf

MALICIOUS — vomaxapuna.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 6c4c3228e2e3c7bc2081a12d489a10a05228152373be16a8f0090382c1486a6e
• SHA-1: bc4720b23a2e6156ef1a1d55185e7f1a6207009a
• MD5: b4280fcfb8cdfc1fb0fbff034921e920
• ssdeep: 1536:4wYYfTCoVQRX3sOQhUHhVUZCax7fN+VbG2RnkCCUHvxglma2SBSUBhx:ZYcZVwX37tYLNGs2SB7Z
• TLSH: T14636D1F7515BEC4DFB439B435AA6251C2886C7493433D72048C86A2DC9BC6FDAF24921
• Submitted as: vomaxapuna.pdf
• File type: pdf · Size: 66582 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd07519d104e5f152f3311/1606223698886/27820543678.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffmen.ru/wb?keyword=car%20logo%20quiz%20game%20free, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd07519d104e5f152f3311/1606223698886/27820543678.pdf, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf3964f98375720a5bc79/1606284184465/potudivot.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffmen.ru/wb?keyword=car%20logo%20quiz%20game%20free
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd07519d104e5f152f3311/1606223698886/27820543678.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf3964f98375720a5bc79/1606284184465/potudivot.pdf
• https://ramakizuwag.weebly.com/uploads/1/3/4/3/134321509/6993820.pdf
• https://static1.squarespace.com/static/5fc509ea5687f52b6b9bd065/t/5fd71507de5b1220c0428cc5/1607931144130/vizio_sound_bar_manual_optical_cable.pdf
• https://static1.squarespace.com/static/5fc370a42cf09257bd7c0e07/t/5fcc244e24c49707d30fa810/1607214163306/javoxenigokobogi.pdf
• https://static1.squarespace.com/static/5fc5a88b8787e879898c667c/t/5fcfc8f03d67b52ba3c19a93/1607452913906/best_online_computer_games_2000s.pdf
• https://static1.squarespace.com/static/5fbffbf92e34347c703edab4/t/5fce6c97d235d37878fbd9ca/1607363736307/botifobapek.pdf
• https://static1.squarespace.com/static/5fc54070c14dfd36fe0e2b11/t/5fc6c9f5e2dcb1274dda09e7/1606863353684/good_co_op_switch_games.pdf
• https://static1.squarespace.com/static/5fc526639955c744b556fee0/t/5fc7c5f4f73774391a49c686/1606927862751/godiwuf.pdf
• https://s3.amazonaws.com/kudefem/89095006788.pdf
• https://paboludozov.weebly.com/uploads/1/3/4/3/134333588/d1f1072fd7133.pdf
• https://static1.squarespace.com/static/5fc59d7c68612547ed7e118f/t/5fcbf3565177ea328cab7d38/1607201622821/79370317066.pdf
• https://static1.squarespace.com/static/5fc00a5311f6a4198480ec6e/t/5fc12ebfcb3e0f57717a0e58/1606495935240/internal_medicine_personal_statement_reddit.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• static1.squarespace.com
• ramakizuwag.weebly.com
• s3.amazonaws.com
• paboludozov.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report