MALICIOUS — kipok-laguwur.pdf

MALICIOUS — kipok-laguwur.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: a18d9212ce4b8071252b89a26af3325d310204c239748d4af3c50c55cdf0e556
• SHA-1: 703ca9f0d05e6f320d6533fd344517242659490a
• MD5: e3633a47f18a2d0c943ae3916c7334bd
• ssdeep: 1536:krCm5/2otTdpj9zo/bju8kj6RabMfD/Y7KPARp0xBi5+NjmKfUgOsSwXPbH+zUDZ:/gdhvlfr6RawxPYYlXPT+zUD3um
• TLSH: T1E43BE1F36267DE8C7352A7033BFE1664A049874C71209661889CF73CC8BC6BC5E54A62
• Submitted as: kipok-laguwur.pdf
• File type: pdf · Size: 104145 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc16e55e9fc3622d525ddac/t/5fc585a2a97599144eb6288b/1606780326241/87569389388.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffset.ru/wb?keyword=15%20north%20freeway%20traffic%20report, https://static1.squarespace.com/static/5fc16e55e9fc3622d525ddac/t/5fc585a2a97599144eb6288b/1606780326241/87569389388.pdf, https://cdn-cms.f-static.net/uploads/4379614/normal_5f9fd0b7eafc7.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/wb?keyword=15%20north%20freeway%20traffic%20report
• https://static1.squarespace.com/static/5fc16e55e9fc3622d525ddac/t/5fc585a2a97599144eb6288b/1606780326241/87569389388.pdf
• https://cdn-cms.f-static.net/uploads/4379614/normal_5f9fd0b7eafc7.pdf
• https://static1.squarespace.com/static/5fc6d9abe9133927d90b22aa/t/5fcf3c348b174454e99b1c66/1607416885203/wallpapers_for_among_us_fanart_realistic.pdf
• https://static1.squarespace.com/static/5fc50ec912facd59cec7ad64/t/5fcae84e551bdc47e79e2026/1607133263834/the_sims_4_cheats_xbox_one_money.pdf
• https://static1.squarespace.com/static/5fc578f6405d5340f3488c89/t/5fd6507cc4373837b90897d7/1607880828936/android_java_autoresetevent.pdf
• https://static1.squarespace.com/static/5fc3978f60f2895dc1f8b122/t/5fcbe61ba0b42e3566b599a8/1607198241746/turemozub.pdf
• https://tivurenufetoza.weebly.com/uploads/1/3/4/2/134235987/xagapexeledonoko.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf683961e25426e130fd50/1606379579076/steroid_and_peptide_hormones_biology_discussion.pdf
• https://static1.squarespace.com/static/5fc10ac260f2895dc1e8a19d/t/5fc149a83485235c86f65571/1606502825850/toledo_technology_academy_schedule.pdf
• https://cdn-cms.f-static.net/uploads/4383922/normal_5f944be8cd2a7.pdf
• https://static1.squarespace.com/static/5fc584cb17e7202640095cc5/t/5fca3dbc9bc93d20d9b97937/1607089596813/fiwimofiwenaru.pdf
• https://suwanozafedo.weebly.com/uploads/1/3/4/5/134587456/kasoveva.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5b5b4e98326c0207e8d0/1606376284068/gizagubekiteruj.pdf
• https://static1.squarespace.com/static/5fc13405bdb33045eec44b84/t/5fc87599ee804a17a1d279ff/1606972825822/car_driver_2_hard_parking_apk_download.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• static1.squarespace.com
• cdn-cms.f-static.net
• tivurenufetoza.weebly.com
• suwanozafedo.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

File paths

• v:\3(

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report