MALICIOUS — 1606e82705fdaf---611818775.pdf
MALICIOUS — 1606e82705fdaf---611818775.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7628b7ead5c6d9dcb900ea6a52a049de961e18e5f33aab6422b785bbd47e0e2c - SHA-1:
ea5ef5002a30025f140b13e352ee2c756bf6ec84 - MD5:
620140b16154ca33ff77ebd8dcddcf9a - ssdeep:
1536:BzTtDgDe1MlRMMsgaDdomifB0grRU76dTGSUkVsU:BRgDBlRBmifB0+q6dvx5 - TLSH:
T19937C0F3B21FDD8C7BC56F1769F60C645489E68C65269BA400887BACC4783BCAF04A51 - Submitted as: 1606e82705fdaf---611818775.pdf
- File type: pdf · Size: 70667 bytes
- Verdict: malicious (94/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!620140B16154
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://www.mothercare.ro/sites/default/files/webform/resumes/xigidaz.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://www.enwidth.com/sites/default/files/webform/resumes/21555212736.pdf, https://campusrec.princeton.edu/system/files/webform/18758627140.pdf, https://www.mothercare.ro/sites/default/files/webform/resumes/xigidaz.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- http://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=body+image+worksheets+pdf
- https://www.enwidth.com/sites/default/files/webform/resumes/21555212736.pdf
- https://campusrec.princeton.edu/system/files/webform/18758627140.pdf
- https://www.mothercare.ro/sites/default/files/webform/resumes/xigidaz.pdf
- https://www.healthdata.org/sites/default/files/resumes/mevupuxapiledowitire.pdf
- https://minorsoncampus.princeton.edu/system/files/webform/posilo.pdf
- https://www.natsihwa.org.au/sites/default/files/webform/doxuwekuwazomiloxeri.pdf
- https://www.dgs-interparts.be/sites/default/files/muvok.pdf
- https://www.dgs-interparts.be/sites/default/files/jinez.pdf
- https://community.princeton.edu/system/files/webform/boranewibutafale.pdf
- https://ambrose.edu/sites/default/files/webform/ginigiwosumomigari.pdf
- https://www.healthdata.org/sites/default/files/resumes/18848190838.pdf
- https://www.ofalloncasting.com/sites/default/files/webform/geguridafaj.pdf
- https://thesanfordschool.asu.edu/sites/default/files/webform/83703622856.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- feedproxy.google.com
- www.enwidth.com
- campusrec.princeton.edu
- www.healthdata.org
- minorsoncampus.princeton.edu
- www.natsihwa.org.au
- www.dgs-interparts.be
- community.princeton.edu
- ambrose.edu
- www.ofalloncasting.com
- thesanfordschool.asu.edu
- www.w3.org
- purl.org
- ns.adobe.com
- www.mothercare.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report