MALICIOUS — 19979928455.pdf
MALICIOUS — 19979928455.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6caa39f31a4caef05f9855909c314953aae414d0e3f52442c0a56214ed583116 - SHA-1:
4c38051e49ff1f9eb0dc6b36ab80ff54e20cf641 - MD5:
86862aed51e90c93dfa81e4cf85bf151 - ssdeep:
1536:aWKvbzFH9lx6TxSbpAew+17v8J7nszWcobh0FcuNWOpOwrPS5YAQR:OBLo8AOJ8JrsSyqwrK2d - TLSH:
T17E37BEF33097DD8C774A9F03B9EB01A8648AC74921B3DB909488767CC07C57DAB18A91 - Submitted as: 19979928455.pdf
- File type: pdf · Size: 70278 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://ecohort.com/userfiles/files/xaxumagof.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://crewmak.ru/uplcv?utm_term=your+friend+invite+your+birthday+party, http://chongros.com/userData/board/file/nikafukudejuxatomujuxazi.pdf, http://ippon.lv/uploads/File/wigesotajavisoxe.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://crewmak.ru/uplcv?utm_term=your+friend+invite+your+birthday+party
- http://chongros.com/userData/board/file/nikafukudejuxatomujuxazi.pdf
- http://ippon.lv/uploads/File/wigesotajavisoxe.pdf
- http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/161356c8c4971f---ruwinidorapafegatajewawas.pdf
- https://ateneoarbonaida.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614d410fb1a53---96064763893.pdf
- https://www.goldenplanet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16130cda24bb20---kogotewifamaluw.pdf
- https://ladychief.com/wp-content/plugins/super-forms/uploads/php/files/4c0683e83cecb8688d026af29709b555/vomajufijire.pdf
- http://www.thebetterinsurance.com/wp-content/plugins/formcraft/file-upload/server/content/files/16150ec5d72fa7---xefikemonarivuge.pdf
- http://ecohort.com/userfiles/files/xaxumagof.pdf
- http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1614846730340e---55068537719.pdf
- http://coverybox.box8websites.com/ckfinder/userfiles/files/dimimosesugalatawegus.pdf
- http://tvoirostov.ru/ckfinder/userfiles/files/99097363742.pdf
- http://www.feniuniversity.edu.bd/app/webroot/ckfinder/userfiles/files/kozojozuvoverakunereje.pdf
- http://elistaprezentow.pl/userfiles/file/dalakukulus.pdf
- http://wwm-quanta.com/upload/files/2549826867.pdf
- https://at2-turbo-j3t.com/contents/files/91293047798.pdf
- http://iknow.pl/files/file/69408764586.pdf
- http://senvietsystem.com/ckeditor/upload/files/97560336291.pdf
- http://kuhomania.ru/ckfinder/userfiles/files/jerumugu.pdf
- http://veterina-hrib.cz/user-uploads/files/33296692148.pdf
- http://thangmayedex.com/webroot/img/files/63621754642.pdf
- http://moskvaznaet.ru/upload/files/80411669572.pdf
- http://pansophers.com/wp-content/plugins/formcraft/file-upload/server/content/files/16140d6360f2b9---59465546150.pdf
- http://wawa757.com/uploads/files/dufakipop.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- crewmak.ru
- chongros.com
- www.cuerpomenteyespiritu.es
- ateneoarbonaida.com
- ladychief.com
- www.thebetterinsurance.com
- ecohort.com
- www.timtransportes.com
- coverybox.box8websites.com
- tvoirostov.ru
- elistaprezentow.pl
- wwm-quanta.com
- at2-turbo-j3t.com
- iknow.pl
- senvietsystem.com
- kuhomania.ru
- thangmayedex.com
- moskvaznaet.ru
- pansophers.com
- wawa757.com
- www.w3.org
- purl.org
- ns.adobe.com
- ippon.lv
- www.goldenplanet.dk
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report