MALICIOUS — 973a7d_e846e01592d94947a7c0ae4b0f93860e.pdf
MALICIOUS — 973a7d_e846e01592d94947a7c0ae4b0f93860e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
92adaed998a098e46f97aa3444061eb05c9b1a3866311538fecfdab3c8c481b1 - SHA-1:
c2cb7e2bd9c5353a93fdea8792a83cffd215f65e - MD5:
8ff86976971585c4298eb45162f498d1 - ssdeep:
1536:QmCbYj6aS8pxLpEYMZYU8FYoenNlqcdTLtOiyfgQAj:XCUO29EX8K4cdTLxyfa - TLSH:
T19B37D0F361ABEC4CB6A69B471EA6616C7099D7C93233D7240084B29CC17C37EBE54950 - Submitted as: 973a7d_e846e01592d94947a7c0ae4b0f93860e.pdf
- File type: pdf · Size: 73382 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!8FF869769715
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://64e18f06-8a0e-4dc1-8427-9dd81b4bff36.filesusr.com/ugd/baa514_dfa9de988beb4900a8588191496154bd.pdf?index=true - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://nipisod.ru/wix?keyword=beaks+of+finches+lab+teacher%2527s+guide, https://64e18f06-8a0e-4dc1-8427-9dd81b4bff36.filesusr.com/ugd/baa514_dfa9de988beb4900a8588191496154bd.pdf?index=true, http://litufowanukoro.epizy.com/25358971241.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://nipisod.ru/wix?keyword=beaks+of+finches+lab+teacher%2527s+guide
- https://64e18f06-8a0e-4dc1-8427-9dd81b4bff36.filesusr.com/ugd/baa514_dfa9de988beb4900a8588191496154bd.pdf?index=true
- http://litufowanukoro.epizy.com/25358971241.pdf
- http://naregoref.22web.org/boylestad_electronic_devices_and_circuit_theory.pdf
- http://dasukegejiwav.iblogger.org/24913843431.pdf
- https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_f75902206e4347de8c011dd4d44df23b.pdf?index=true
- https://s3.amazonaws.com/divikufifir/what_is_the_medicaid_penalty_for_gifts.pdf
- https://s3.amazonaws.com/mesotodimus/adelaide_tv_guide_sunday.pdf
- http://pobevejilu.rf.gd/revista_hinode_ciclo_4_2020.pdf
- http://kasirepimadi.iblogger.org/architecture_drawing_tools_kit.pdf
- https://s3.amazonaws.com/filidabut/34850334227.pdf
- http://fusakorupisizeg.iblogger.org/suleketekezorifuretut.pdf
- http://velefejaforafe.rf.gd/bujisafezokexorepajezimev.pdf
- https://s3.amazonaws.com/zaxefemebidaz/99920859817.pdf
- http://xumolax.rf.gd/sedentarismo_causas_y_consecuencias.pdf
- http://mosasekoz.22web.org/word_order_exercises_with_answers.pdf
- https://s3.amazonaws.com/pegozegi/brother_hl_2140_remove_toner_cartridge.pdf
- https://a6132035-7465-4fe4-be4e-2faa96c22dab.filesusr.com/ugd/cf950b_c3a28f5c8544460a9cccc8af72bc2bf1.pdf?index=true
- https://s3.amazonaws.com/kiguteperilodu/nurimekotonix.pdf
- http://dokovavoxibasu.rf.gd/41676413277.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- nipisod.ru
- 64e18f06-8a0e-4dc1-8427-9dd81b4bff36.filesusr.com
- litufowanukoro.epizy.com
- naregoref.22web.org
- dasukegejiwav.iblogger.org
- c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com
- s3.amazonaws.com
- kasirepimadi.iblogger.org
- fusakorupisizeg.iblogger.org
- mosasekoz.22web.org
- a6132035-7465-4fe4-be4e-2faa96c22dab.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
- pobevejilu.rf.gd
- velefejaforafe.rf.gd
- xumolax.rf.gd
- dokovavoxibasu.rf.gd
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report