MALICIOUS — 86b6ac4881f42bebf26843d4e89db1f79222f76f9ddc53dac358cbc6c118c915
MALICIOUS — 86b6ac4881f42bebf26843d4e89db1f79222f76f9ddc53dac358cbc6c118c915 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
86b6ac4881f42bebf26843d4e89db1f79222f76f9ddc53dac358cbc6c118c915 - SHA-1:
5ad27b64ca82d529f8fbc6c735f5168c8515942d - MD5:
06291f9082f5b3c03251da8182a37c8a - ssdeep:
1536:zMM55JNBmYkHO/HTv3886++/DaQjFjmLWCpOViAf3W4G5WuH5YWL:tpN4YaWH486ZLJ3ViuJgW8X - TLSH:
T12037BFF320DBDD8C769BDF0379E60159608AE78C3162EAA484C8767CD57C97DAE40980 - Submitted as: 86b6ac4881f42bebf26843d4e89db1f79222f76f9ddc53dac358cbc6c118c915
- File type: pdf · Size: 71903 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://bifruit.mk/ckfinder/userfiles/files/31609348238.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://infrive.ru/uplcv?utm_term=phone+call+apk, http://milwaukee.center/userfiles/file/visogagi.pdf, http://www.eurosecurimed.com/ckfinder/userfiles/files/tibowafuzikusugolawa.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://infrive.ru/uplcv?utm_term=phone+call+apk
- http://milwaukee.center/userfiles/file/visogagi.pdf
- http://www.eurosecurimed.com/ckfinder/userfiles/files/tibowafuzikusugolawa.pdf
- http://primaria-ciocirlia.ro/media/file/13042244732.pdf
- http://le-lemniscus-incandescent.fr/ckeditor/upload/files/21747033991.pdf
- http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614acd92db8d1---4712506894.pdf
- https://bibliotheque.ville.deux-montagnes.qc.ca/ckfinder/userfiles/files/soxanipigefebonukar.pdf
- http://bifruit.mk/ckfinder/userfiles/files/31609348238.pdf
- https://bushregenerators.info/userfiles/files/25113294444.pdf
- http://rymwid-training.com/userfiles/file/defepiwidodivaki.pdf
- https://universitecentrale.net/uploads/FCK_files/file/28935328529.pdf
- https://hv2barrier.com/application/third_party/ckfinder/userfiles/files/kugajaxinu.pdf
- https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/90c929ca6a97c9f0fd1da29f52c924ac/nejesiponijexaj.pdf
- https://naseeha.org/wp-content/plugins/super-forms/uploads/php/files/70c002aeede181e4fc28c5b4fb9f1cbb/4911732975.pdf
- http://anchor-m.com/js/upload/files/tebaj.pdf
- http://www.auditsi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613134672f156---27324214684.pdf
- http://www.ecvbrass.ch/user/web/file/rozagozobibodugidag.pdf
- https://www.revistadefiesta.com/wp-content/plugins/formcraft/file-upload/server/content/files/16143a7101bb85---dajukipuloralubu.pdf
- http://kanalizace-ul.cz/userfiles/file/79383589496.pdf
- https://parkettworld.com/upload/files/tepepidizebunowuj.pdf
- https://hgb.se/filer/file/4408773390.pdf
- http://praconsulgroup.ru/pict/file/fonigigifopufapegegujir.pdf
- http://slesnick.net/userfiles/files/nelirelover.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- infrive.ru
- www.eurosecurimed.com
- le-lemniscus-incandescent.fr
- bizwd.com
- bibliotheque.ville.deux-montagnes.qc.ca
- bushregenerators.info
- rymwid-training.com
- universitecentrale.net
- hv2barrier.com
- agsposure.org
- naseeha.org
- anchor-m.com
- www.auditsi.com
- www.ecvbrass.ch
- www.revistadefiesta.com
- parkettworld.com
- hgb.se
- praconsulgroup.ru
- slesnick.net
- www.w3.org
- purl.org
- ns.adobe.com
- milwaukee.center
- primaria-ciocirlia.ro
- bifruit.mk
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report