MALICIOUS — 8836980.pdf

MALICIOUS — 8836980.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: a39f2558d71f4cdf3e707a64d9d84e277f902bef7659021fc9fbefcf96922f9f
• SHA-1: ed6f656cbe8d582aea633e7f0153c16b3644e13f
• MD5: bcad3a7aa831d19600c3829bebc7e86e
• ssdeep: 1536:tTfyAOoiMM91KJB7F7gUNHbdnjMF2kpiPf43P+gCWb:9fy7MMeB7xtC2kpqA2g9
• TLSH: T13F37D0F3A587DC0C3B8E7B437AAA155D249AD6CD2032AF64409C772CD1BC6AE7E10941
• Submitted as: 8836980.pdf
• File type: pdf · Size: 72100 bytes
• Verdict: malicious (97/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Phish.gen (rule HEUR:Hoax.PDF.Phish.gen) - engine signal, weight 0.55, confidence 0.85
• Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc3342111f6a4198494abb4/t/5fcaa678e4bfa1297ad3aa93/1607116408703/41525956869.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffnew.ru/wb?keyword=rediscovering%20americanism%20pdf, https://uploads.strikinglycdn.com/files/1ecc77e0-cc81-4e40-8a1a-03c98703334f/zosijifurejumej.pdf, https://bujetukojijem.weebly.com/uploads/1/3/4/8/134875379/fijawanerub_temagixixulu_gulavuvof.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffnew.ru/wb?keyword=rediscovering%20americanism%20pdf
• https://uploads.strikinglycdn.com/files/1ecc77e0-cc81-4e40-8a1a-03c98703334f/zosijifurejumej.pdf
• https://bujetukojijem.weebly.com/uploads/1/3/4/8/134875379/fijawanerub_temagixixulu_gulavuvof.pdf
• https://uploads.strikinglycdn.com/files/9fada277-25a9-425a-a01d-81a271dcffe8/wargame_red_dragon_cheat_engine.pdf
• https://static1.squarespace.com/static/5fc3342111f6a4198494abb4/t/5fcaa678e4bfa1297ad3aa93/1607116408703/41525956869.pdf
• https://uploads.strikinglycdn.com/files/0c958ca8-dc97-4d66-96f2-f4010d9e0bea/kedomopazalibazaj.pdf
• https://uploads.strikinglycdn.com/files/800ad043-4711-430f-8f2a-d2315229263f/forudozimisuvilolujupiji.pdf
• https://s3.amazonaws.com/varolexexus/kikkerland_music_box_sheet_music.pdf
• https://uploads.strikinglycdn.com/files/176fef57-9844-4f46-a27f-0cd28ebf90dd/sojujitoz.pdf
• https://uploads.strikinglycdn.com/files/a21abb1c-a1c8-4b20-beb7-76b4b158c885/38755908320.pdf
• https://static1.squarespace.com/static/5fc2bed292c50b1a1e8370b6/t/5fd1db9499fe644e8a61e4e2/1607588758902/krita_animation_review.pdf
• https://uploads.strikinglycdn.com/files/f71874f5-1306-408a-9631-5f5355c0fee6/12_laws_of_karma_simple_reminders.pdf
• https://uploads.strikinglycdn.com/files/491b5df2-cf2d-406b-971d-3a8fe0923586/la_relation_d_aide_carl_rogers.pdf
• https://s3.amazonaws.com/fedojigudaj/17720000941.pdf
• https://uploads.strikinglycdn.com/files/25e7acf6-f236-44be-ad2c-75bb4ca0a8a9/27764009786.pdf
• https://uploads.strikinglycdn.com/files/a21b3382-94c0-4a4c-b595-a7de257ba932/frederick_douglass_letter_to_harriet_tubman_answers.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• uploads.strikinglycdn.com
• bujetukojijem.weebly.com
• static1.squarespace.com
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report