MALICIOUS — 20210621165310105.pdf
MALICIOUS — 20210621165310105.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a50967c16db7859363cb6c03ba9608c480d805a8bc757da5b08d69bdb2ab0204 - SHA-1:
cf3a19732dd0df9f57d56234b953b8d24ba07c0d - MD5:
746d3b3b46570ac3009efa39c6f54806 - ssdeep:
1536:MVPbVPUnyQuFCK/0/8wy+PprUqH3KqA14fo7EEbs6wrAOt0K3VU8r:cbV8tu5+Pt9bA14hKs6wrt0K3V5 - TLSH:
T1FA37D0F37197CE8C7A9E5B43A8F92559A088E7493072D3748488B6BC847C2FE6F10951 - Submitted as: 20210621165310105.pdf
- File type: pdf · Size: 74742 bytes
- Verdict: malicious (96/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!746D3B3B4657
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://jump360.co/upload/files/20210611064706.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: http://jump360.co/upload/files/20210611064706.pdf, http://robertfeinberglaw.com/images/edit_images/file/vewexumuwaxirodigim.pdf, https://gradeagroup.com/wp-content/plugins/super-forms/uploads/php/files/e0gfk2r0hi1kqjvp97do5l8b88/42842630965.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=regent+weakness+persona+5
- http://jump360.co/upload/files/20210611064706.pdf
- http://robertfeinberglaw.com/images/edit_images/file/vewexumuwaxirodigim.pdf
- https://gradeagroup.com/wp-content/plugins/super-forms/uploads/php/files/e0gfk2r0hi1kqjvp97do5l8b88/42842630965.pdf
- http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/j4isbhfehdb253mj7vinsfqtbo/15794694577.pdf
- https://harpethvalleypto.org/wp-content/plugins/super-forms/uploads/php/files/3c459f18c719ebaa214c3410bd622c68/92972365950.pdf
- http://youandisagenix.com/ckfinder/userfiles/files/wikadebonalagogusaxanevel.pdf
- https://www.chartsunlimited.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/1607ad12b0de13---74330110826.pdf
- http://theopenhouseclub.com/wp-content/plugins/super-forms/uploads/php/files/8caab7b440b3ff910d8eef1c25c7be99/98107789958.pdf
- https://dtcprojects.com.au/wp-content/plugins/super-forms/uploads/php/files/7ngig6oj4mbni6grsbtngcmgjt/kumizulidolu.pdf
- https://steklo-shik.ru/userfiles/file/82241717538.pdf
- https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160b843f8f18a1---kilazijejalalonedemu.pdf
- https://bnbcostaverde.it/userfiles/file/33512558735.pdf
- https://joefairless.com/wp-content/plugins/super-forms/uploads/php/files/4d5968b06692365fd5490b220b944cb4/881739226.pdf
- http://bereanbaptistashton.com/clients/1/1c/1ca8668e480cca1e897b6add33210fc6/File/gonivofigebewefoji.pdf
- http://structurecreative.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7aa58f89c---20231593741.pdf
- https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160811874579bb---69865108426.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- feedproxy.google.com
- jump360.co
- robertfeinberglaw.com
- gradeagroup.com
- kingspec.su
- harpethvalleypto.org
- youandisagenix.com
- theopenhouseclub.com
- dtcprojects.com.au
- steklo-shik.ru
- bnbcostaverde.it
- joefairless.com
- bereanbaptistashton.com
- structurecreative.com
- drivingschoolofnorthtexas.com
- www.w3.org
- purl.org
- ns.adobe.com
- www.chartsunlimited.com.ph
- webmodels.studio
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report