MALICIOUS — 88ca3a77f75ee3248b4b5af37562356cdec3a0892c70d5c769bb136edcb4360f
MALICIOUS — 88ca3a77f75ee3248b4b5af37562356cdec3a0892c70d5c769bb136edcb4360f is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
88ca3a77f75ee3248b4b5af37562356cdec3a0892c70d5c769bb136edcb4360f - SHA-1:
c8f92720a7dfc578cc7c1662a721d5779946a36a - MD5:
55111c00d190add0c89b1c6963b7a862 - ssdeep:
1536:W3/yD94L8MX/IDCi1dqPbZ3RMj84Za3BY2WQ0F4:U/AWqDRSDMER90G - TLSH:
T15335D0E314B79E4CB75F5B039EFA632FD44EE34980A7D26414481BA8D0AC97EBD41A40 - Submitted as: 88ca3a77f75ee3248b4b5af37562356cdec3a0892c70d5c769bb136edcb4360f
- File type: pdf · Size: 58920 bytes
- Verdict: malicious (96/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://vnationwide.com/userfiles/files/45862496618.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: http://zeci.nl/im/image/wewif.pdf, https://mbzgogo.xyz/web/img/podborky/files/90378578924.pdf, http://liccuza.ro/stiri_files/file/daziwamaludimeraxelozawoz.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/Gsjc/~3/1hHberoKktI/uplcv?utm_term=davido+ft+french+montana+blessings
- http://zeci.nl/im/image/wewif.pdf
- https://mbzgogo.xyz/web/img/podborky/files/90378578924.pdf
- http://liccuza.ro/stiri_files/file/daziwamaludimeraxelozawoz.pdf
- https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/e9830d9c85e065a46c40bca6c64005d5/nalolutisukogel.pdf
- https://jv-cms.crazy-jessie.nl/uploads/files/nisexirirewonu.pdf
- http://lnv-cnc.com/userfiles/file/97764481500.pdf
- http://vnationwide.com/userfiles/files/45862496618.pdf
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/85ed434ddfa5de491e831d3526d99bad/metejemibutebaxizegobif.pdf
- http://vasset.bg/userfiles/file/zavafinevidugumo.pdf
- http://siripanyalamphun.com/user_img/files/75715418388.pdf
- https://manajrgvaaradhi.com/cms-uploads/files/44828179699.pdf
- http://www.childofafrica.org/media/userfiles/file/95725177096.pdf
- https://fentesmakina.com/paket/upload/files/tanole.pdf
- http://nacyc.jp/Upload/file/42949945342.pdf
- https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613998a949289.pdf
- http://renovfab-menuiserie.com/userfiles/file/8093525873.pdf
- http://sgrdpandher.com/userfiles/file/dexevesolikorina.pdf
- http://hndgyl.com/v15/Upload/file/20211071829304375.pdf
- http://gallery4walls.com/upload/editer/file/kebewugituv.pdf
- http://fonnepal.org/userfiles/file/wixemap.pdf
- http://futuralagoparking.eu/userfiles/files/28594462321.pdf
- http://studiotipaldo.com/userfiles/files/pisoralexanus.pdf
- http://yusungchart.com/userData/board/file/koligiditamol.pdf
- https://amatnieks.lv/pictures/image/terumasexegutosepipagamu.pdf
Embedded domains
- feedproxy.google.com
- zeci.nl
- mbzgogo.xyz
- donnasalon.ru
- jv-cms.crazy-jessie.nl
- lnv-cnc.com
- vnationwide.com
- gift-edu.ru
- siripanyalamphun.com
- manajrgvaaradhi.com
- www.childofafrica.org
- fentesmakina.com
- nacyc.jp
- ventana-sur.com
- renovfab-menuiserie.com
- sgrdpandher.com
- hndgyl.com
- gallery4walls.com
- fonnepal.org
- futuralagoparking.eu
- studiotipaldo.com
- yusungchart.com
- liccuza.ro
- vasset.bg
- amatnieks.lv
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report