MALICIOUS — 7b06c7af4fcd287de876a758c38ca3095c9d4a19cdf404eef8ab2d641b079177
MALICIOUS — 7b06c7af4fcd287de876a758c38ca3095c9d4a19cdf404eef8ab2d641b079177 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7b06c7af4fcd287de876a758c38ca3095c9d4a19cdf404eef8ab2d641b079177 - SHA-1:
d973a4d84b37f90800afc34c44cc8904e4c14c31 - MD5:
46d542edfaab2d451e11c336f9f35e89 - ssdeep:
1536:7wM6LE3lPq0t5tlogz/fK5nQWiRo/Q7LpuSPxhwWHpOvTWoZRwpoM3S:rFqO5trGn8Ro4fpuSP/IvZZqSM3S - TLSH:
T1E636D0F751A7CC8C7E4AFB427ABB21A9D08EE7885165F51041CC67A891FC9BEBD00610 - Submitted as: 7b06c7af4fcd287de876a758c38ca3095c9d4a19cdf404eef8ab2d641b079177
- File type: pdf · Size: 65820 bytes
- Verdict: malicious (94/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://www.shipsupply.co.mz/wp-content/plugins/formcraft/file-upload/server/content/files/1606ccc299fe2c---bubilawej.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://www.marbelitesa.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160827c8531951---bafakovuteferofizofarof.pdf, http://3dtechgroup.com/uploads/image/files/vatebozidoredopamo.pdf, https://jennysbooks.com/wp-content/plugins/super-forms/uploads/php/files/62191034dd874b97ab5a66850b020455/78832117355.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=about+benzoic+acid
- https://www.marbelitesa.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160827c8531951---bafakovuteferofizofarof.pdf
- http://3dtechgroup.com/uploads/image/files/vatebozidoredopamo.pdf
- https://jennysbooks.com/wp-content/plugins/super-forms/uploads/php/files/62191034dd874b97ab5a66850b020455/78832117355.pdf
- https://smoothnomad.com/wp-content/plugins/super-forms/uploads/php/files/g73pec38kf421b7gpvgcc6om3k/ranapupesino.pdf
- https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d5f9ec5b4df---xamuwejaga.pdf
- http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab8eda62388---47705743590.pdf
- http://www.grupohk.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b647d29ea03---bugorapepenot.pdf
- http://odessahighschool1970.com/clients/7/70/70263b1be1b93b62200e198143f59f20/File/12564912226.pdf
- http://www.shipsupply.co.mz/wp-content/plugins/formcraft/file-upload/server/content/files/1606ccc299fe2c---bubilawej.pdf
- https://legacyltg.com/wp-content/plugins/super-forms/uploads/php/files/effe0dd964a43e209bc8e3ebaecac0dc/gupizevilimikudazufotep.pdf
- https://aduanaldelvalle.com/userfiles/file/difujozopulojudekok.pdf
- https://www.schroedersales.com/wp-content/plugins/super-forms/uploads/php/files/9ec5668eaa799ca9039fa2225994e137/2752204723.pdf
- https://upbfassadenbau.com/upload/file/noniwawibika.pdf
- http://becro-plast.hr/wp-content/plugins/formcraft/file-upload/server/content/files/16075bebf07e39---63782942045.pdf
- https://www.bakirkoytemsilcisi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606e0fa354cd8---waviv.pdf
- http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/3bu6ocnv0hve1c07kqk26a0uqa/30854846425.pdf
- http://alhouti.com/userfiles/file/85001371379.pdf
- http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/f30a38dab3b4074b3ac494b48ba1e8bc/30718236417.pdf
- https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/0ad290f40bbfa7d79cfb8b6734285c90/bivumaluzuditopawika.pdf
- http://www.sunargrup.com.tr/wp-content/plugins/super-forms/uploads/php/files/0g9io73le1skodc9ah5kvj1ve0/23176424710.pdf
- https://ludifrance.fr/userfiles/file/kuwodazomilemojowewofarav.pdf
- https://triosms.com/userfiles/file/fexogub.pdf
- http://rolmech-strzelno.pl/Upload/file/84021530583.pdf
Embedded domains
- feedproxy.google.com
- www.marbelitesa.co.za
- 3dtechgroup.com
- jennysbooks.com
- smoothnomad.com
- www.temsilcisitesi.com
- zawayakw.com
- www.grupohk.com.br
- odessahighschool1970.com
- legacyltg.com
- aduanaldelvalle.com
- www.schroedersales.com
- upbfassadenbau.com
- www.bakirkoytemsilcisi.com
- subventionsbetrug.de
- alhouti.com
- www.pirac.org
- cms.blauraum.com
- ludifrance.fr
- triosms.com
- rolmech-strzelno.pl
- www.shipsupply.co.mz
- becro-plast.hr
- www.sunargrup.com.tr
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report