MALICIOUS — xaxumagof.pdf
MALICIOUS — xaxumagof.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7b18d693163c47b792e7447eec8cfde2b617e4b6f26f2f2dff0c1302aafed952 - SHA-1:
54a4671140d11d5edf1d6a442bff7716c961a203 - MD5:
58a858fabe80ff2b5c4be9a0ab78cb9d - ssdeep:
1536:2AZTJ2tjaTMdDGQyCU+AboV5cXS2WvyyTN2oU2gWQpOCjS/2kPOqBcGT:VZTcaT1hg6onYoU2PCE2+rH - TLSH:
T1F637C0F351EBED1C7B8B9B4365FA01996049D78462B2EBA00080BB6CC57C5BE7F10661 - Submitted as: xaxumagof.pdf
- File type: pdf · Size: 76464 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://okazdedziecko.pl/_files/Media/file/42044272025.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: http://hkalc.com/userfiles/koxetako.pdf, https://drbumbnursinghome.in/ckfinder/userfiles/files/46661475118.pdf, https://thanaclusterwestgate.leaddeehub.com/userfiles/files/wekozebij.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=ullu+free+video+watch
- http://hkalc.com/userfiles/koxetako.pdf
- https://drbumbnursinghome.in/ckfinder/userfiles/files/46661475118.pdf
- https://thanaclusterwestgate.leaddeehub.com/userfiles/files/wekozebij.pdf
- https://gianlucabruno.it/dati/upload/file/29078406809.pdf
- http://appli-veolia.net/ckfinder/userfiles/files/futobugaxubovatobo.pdf
- http://donghozibistore.com/luutru/files/lepuxuraxodurejelezusegu.pdf
- http://bharatdarshan.net/rgroup/ckfinder/userfiles/files/70013852245.pdf
- http://sun-marche.com/app/webroot/js/ckfinder/userfiles/files/36492658113.pdf
- https://basealimentare.it/webroot/files/fck_uploads/File/3059841617.pdf
- https://okazdedziecko.pl/_files/Media/file/42044272025.pdf
- http://www.tobywells.org/media/fckdir/file/rebid.pdf
- http://vincityhomes.vn/wp-content/plugins/super-forms/uploads/php/files/q2fkpdrkki7146julj0fosc3vl/50198362032.pdf
- https://probidjp.com/ckfinder/userfiles/files/20210917_165912.pdf
- https://mokhalasati.com/userfiles/files/67817420838.pdf
- http://balashixa.inhome360.ru/admin/ckfinder/userfiles/files/fojawexurarulododutag.pdf
- http://agisma.ru/files/pages/files/31469519467.pdf
- http://banquat.com/userfiles/files/45819845378.pdf
- https://pragatitic.org/ckfinder/userfiles/files/84233943854.pdf
- http://maxgear.cz/webpagebuilder/ckfinder/userfiles/files/guvabiferedak.pdf
- http://www.c-l-r-p.com/admin/ckfinder/userfiles/files/14239395113.pdf
- https://bliznacite.com/files/58878337790.pdf
- http://le383.com/uploads/files/xulimanarakimaj.pdf
- http://sea-cruise.ru/ckfinder/userfiles/files/97078461246.pdf
- http://fairway.cc/images/blog/file/jamujoriwuzamano.pdf
Embedded domains
- feedproxy.google.com
- hkalc.com
- drbumbnursinghome.in
- thanaclusterwestgate.leaddeehub.com
- gianlucabruno.it
- appli-veolia.net
- donghozibistore.com
- bharatdarshan.net
- sun-marche.com
- basealimentare.it
- okazdedziecko.pl
- www.tobywells.org
- probidjp.com
- mokhalasati.com
- balashixa.inhome360.ru
- agisma.ru
- banquat.com
- pragatitic.org
- www.c-l-r-p.com
- bliznacite.com
- le383.com
- sea-cruise.ru
- fairway.cc
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report