MALICIOUS — 7846104.pdf

MALICIOUS — 7846104.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a1abba652455fd67967e2198d262f215667b1b3063a4b29cca2915100632598f
SHA-1: 85f4343f67c72ea1191e37da0f4fc7ce5496571b
MD5: 1a16ebe3753cb6f236e724b93df7c516
ssdeep: 1536:MIoaKxDd0cA2mbM1uxaI5ye0P/t2za15ngcO1H5rBdWsTLiYFRKx:GxDmc1mo1uxv8eqngcO1JBdWKLiYux
TLSH: T1B837D0F7A08BDE4CB6475B8769EA54256485D70CB13286A089C8BD3CCC783BE3F50542
Submitted as: 7846104.pdf
File type: pdf · Size: 72646 bytes
Verdict: malicious (96/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4369648/normal_5fc59090e848a.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://traffset.ru/wb?keyword=new%20cholesterol%20guidelines%20pdf, https://cdn-cms.f-static.net/uploads/4370064/normal_5f939a19cbf83.pdf, https://static1.squarespace.com/static/5fbfd008c14dfd36feeb1b6e/t/5fc11a433c6ccf69f384ff3b/1606490699873/78377699709.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://traffset.ru/wb?keyword=new%20cholesterol%20guidelines%20pdf
https://cdn-cms.f-static.net/uploads/4370064/normal_5f939a19cbf83.pdf
https://static1.squarespace.com/static/5fbfd008c14dfd36feeb1b6e/t/5fc11a433c6ccf69f384ff3b/1606490699873/78377699709.pdf
https://cdn-cms.f-static.net/uploads/4393499/normal_5faa4cc52d17d.pdf
https://uploads.strikinglycdn.com/files/9ed4a900-d24b-4a07-ad0e-834debd57c5f/wulejulimeviw.pdf
https://uploads.strikinglycdn.com/files/e2ddafab-d406-4228-b613-92111519f368/17808982444.pdf
https://s3.amazonaws.com/minaxigevani/11431203630.pdf
https://static1.squarespace.com/static/5fc655f22bbd7406582ba233/t/5fcc668924c49707d316cda4/1607231114069/ar_rc_boat_fishing_legal.pdf
https://static1.squarespace.com/static/5fc5d8daa5bc066edfc77a21/t/5fcad661bce7087d1ad091ad/1607128673816/race_time_calculator.pdf
https://static.s123-cdn-static.com/uploads/4369648/normal_5fc59090e848a.pdf
https://s3.amazonaws.com/ronatiduzoxij/kotoba.pdf
https://static1.squarespace.com/static/5fc14db9116eb00e3c4eb5a0/t/5fce9014c6c7b04b0353bf70/1607372821848/38295762587.pdf
https://static1.squarespace.com/static/5fc12052bd14ff0dd29e0ecd/t/5fc4506ba97599144e81ff61/1606701165442/write_your_own_myth_ideas.pdf
https://static1.squarespace.com/static/5fc5adf5be9b6939512b78e3/t/5fccbaaf83d2ac65cc107116/1607252657061/fisasapetipawop.pdf
https://cdn-cms.f-static.net/uploads/4379029/normal_5fc1dd111bd22.pdf
https://s3.amazonaws.com/liluvad/nebuzotibotefunimapo.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

traffset.ru
cdn-cms.f-static.net
static1.squarespace.com
uploads.strikinglycdn.com
s3.amazonaws.com
static.s123-cdn-static.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report