MALICIOUS — 3f80ec_ac1b83cf8bbf40c3a606133ebbd58a3d.pdf

MALICIOUS — 3f80ec_ac1b83cf8bbf40c3a606133ebbd58a3d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 9651916bd8a82d7845f2e765b85db055aa09715efddec2e4fda463391e9152ba
• SHA-1: 63554eaab428fd4a862d6948bec7d14673e61614
• MD5: 8bcc09d7a77f3bfba91d9de1b4260e72
• ssdeep: 1536:AfRbBhpexFkTi2DqOzG6XsUkIIEE+lbCefUL2yiaXnppcujuCe:6ThQQLTsUMOfUjNnpp+
• TLSH: T18D38D0F3115BDD8CBBCBAB43E9BB6A1DA48BD7843233D9904594676CC03C6ADAE10510
• Submitted as: 3f80ec_ac1b83cf8bbf40c3a606133ebbd58a3d.pdf
• File type: pdf · Size: 81043 bytes
• Verdict: malicious (94/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!8BCC09D7A77F
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: http://lg-copyrightforms.com/geographical_information_system_book1ti9v.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://jumiwimov.ru/wix?keyword=apk+live+tv+download, http://lg-copyrightforms.com/geographical_information_system_book1ti9v.pdf, http://giocodigital.fun/bopofovukideparosrsc0q.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://jumiwimov.ru/wix?keyword=apk+live+tv+download
• http://lg-copyrightforms.com/geographical_information_system_book1ti9v.pdf
• https://s3.amazonaws.com/golepe/western_blot_analysis_protocol.pdf
• https://s3.amazonaws.com/sefiwegegagu/cosmic_energy_images.pdf
• https://s3.amazonaws.com/befafuni/laporan_pendahuluan_hernia_inguinal.pdf
• https://s3.amazonaws.com/devuxuzejozam/new_oxford_picture_dictionary.pdf
• http://giocodigital.fun/bopofovukideparosrsc0q.pdf
• https://s3.amazonaws.com/gekixadonuru/why_wont_my_samsung_oven_heat_up.pdf
• http://zufemefuzubaje.iblogger.org/kamakunoladebozixabodejiv.pdf
• http://mibewoz.22web.org/nisifofutef.pdf
• http://bejuwenaja.epizy.com/70444133678.pdf
• https://s3.amazonaws.com/lowuwofuxali/19846688722.pdf
• https://s3.amazonaws.com/godewumazek/could_should_would_esl_worksheet.pdf
• http://ig-objectionform.com/death_note_book_type_gamefdqdd.pdf
• http://potenciy.xyz/what_is_dynamic_programming_in_sap_abap7kydf.pdf
• https://s3.amazonaws.com/mefonevimimix/giwegumepotijavabapese.pdf
• http://jonepodifenasoz.epizy.com/wilunonotolekuwozakovujur.pdf
• https://s3.amazonaws.com/nolarifaforuxop/easy_recorder_sheet_music_free.pdf
• https://s3.amazonaws.com/wizitifowubux/av_malformation_of_the_uterus.pdf
• https://s3.amazonaws.com/xalexojaxipud/71805360347.pdf
• https://s3.amazonaws.com/nagev/958322949.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• jumiwimov.ru
• lg-copyrightforms.com
• s3.amazonaws.com
• giocodigital.fun
• zufemefuzubaje.iblogger.org
• mibewoz.22web.org
• bejuwenaja.epizy.com
• ig-objectionform.com
• potenciy.xyz
• jonepodifenasoz.epizy.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report