MALICIOUS — satisulu-bijufusavisa.pdf

MALICIOUS — satisulu-bijufusavisa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8569135cfb8cd89028b9c2b0120401da9bb2a022f7fcb1f64b6d768d21b9ecfc
SHA-1: aaaf55d5a54b6aff199679a57a49072f909ca465
MD5: df71aee757ecc531233991accade7e57
ssdeep: 1536:HXddAcdkE6Z9ZAUS4hx18unMFnEt6qUOLsc6Y720oHHC5cg:NdRCE6PZApURMFsNLsJYjoHHCd
TLSH: T16D38D0F3604BFD4CEA8A574738A615597849D7CC6232A7604888763DC4BC67F2E20E51
Submitted as: satisulu-bijufusavisa.pdf
File type: pdf · Size: 80528 bytes
Verdict: malicious (96/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!DF71AEE757EC
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4413563/normal_60020f73a3fcf.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://zajinet.ru/wb?keyword=how%20to%20start%20a%20heat%20and%20glo%20gas%20fireplace, http://lulopoboxefon.scienceontheweb.net/pokaseduxafubarapawa.pdf, https://static.s123-cdn-static.com/uploads/4413563/normal_60020f73a3fcf.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://zajinet.ru/wb?keyword=how%20to%20start%20a%20heat%20and%20glo%20gas%20fireplace
http://lulopoboxefon.scienceontheweb.net/pokaseduxafubarapawa.pdf
https://static.s123-cdn-static.com/uploads/4413563/normal_60020f73a3fcf.pdf
https://cdn-cms.f-static.net/uploads/4382965/normal_603837d4b1709.pdf
https://s3.amazonaws.com/gezejoputiwinu/idsa_guidelines_treatment_invasive_aspergillosis.pdf
https://s3.amazonaws.com/xeropizuwe/us_citizenship_renunciation_form.pdf
https://s3.amazonaws.com/sedimeraxufi/jukofozu.pdf
https://s3.amazonaws.com/sukedil/72954369512.pdf
https://s3.amazonaws.com/vabedafozo/39984067125.pdf
https://s3.amazonaws.com/tobito/5081576875.pdf
https://s3.amazonaws.com/nunakixuma/54894288008.pdf
https://static.s123-cdn-static.com/uploads/4475719/normal_5fef85322e357.pdf
https://cdn-cms.f-static.net/uploads/4386334/normal_5fe98a0ae0ab5.pdf
https://cdn-cms.f-static.net/uploads/4484383/normal_60218f5bb0e6e.pdf
http://vawerudarasikow.myartsonline.com/35702520420.pdf
https://static.s123-cdn-static.com/uploads/4405181/normal_5fde6c3949541.pdf
http://zagodutaf.getenjoyment.net/what_is_the_best_beatles_greatest_hits_album.pdf
https://s3.amazonaws.com/fumiposamisur/fawix.pdf
https://s3.amazonaws.com/mivokozibu/wemiwuxumodep.pdf
http://mapotilij.mygamesonline.org/the_trials_of_apollo_1_download.pdf
https://cdn-cms.f-static.net/uploads/4480580/normal_6036c4158a40b.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

zajinet.ru
lulopoboxefon.scienceontheweb.net
static.s123-cdn-static.com
cdn-cms.f-static.net
s3.amazonaws.com
vawerudarasikow.myartsonline.com
zagodutaf.getenjoyment.net
mapotilij.mygamesonline.org
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report