MALICIOUS — 11770410388.pdf
MALICIOUS — 11770410388.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a5394c835bf83eef9d86a93c24f6c936ffaf847b723666b3c41e92c66d442644 - SHA-1:
b853030fa387a8790e152fb4d68fb56e1ab1200c - MD5:
1177ac20b8c9623030906052506b7a20 - ssdeep:
1536:KV5Dmd2UHkDsBm9oDxm1cR6aItKNg3ERMWIQ154Z0qDt4tJdsdW8pO+YgwUf:25DmQUEDzfQ6ajSQr4ZTt4SM+Yh0 - TLSH:
T12C39D1F361CBEE0D73AE4B0769E911687486F748A521D6800088B72D9AFC5BD7F18B11 - Submitted as: 11770410388.pdf
- File type: pdf · Size: 91936 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://tourbusan.net/FileData/ckfinder/files/20210910_021F3C7E6BCFEB68.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://oniceh.ru/uplcv?utm_term=gta+vice+city+mobile+game+file, https://kirmatas.com/userfiles/file/jebalefogenuwu.pdf, https://clarkfamilybuilders.com/home/clark/public_html/ckfinder/userfiles/files/vasamaf.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://oniceh.ru/uplcv?utm_term=gta+vice+city+mobile+game+file
- https://kirmatas.com/userfiles/file/jebalefogenuwu.pdf
- https://clarkfamilybuilders.com/home/clark/public_html/ckfinder/userfiles/files/vasamaf.pdf
- https://daqing-jewelry.com/uploads/files/202109031659135696.pdf
- http://tourbusan.net/FileData/ckfinder/files/20210910_021F3C7E6BCFEB68.pdf
- https://vernadoc.com/wp-content/plugins/super-forms/uploads/php/files/22fa477ee04e43281139c546e45bb44d/25073317816.pdf
- http://www.logistiekverbeteren.nl/ckfinder/userfiles/files/5135454583.pdf
- https://unitedfightalliance.jordanadams.com/ckfinder/userfiles/files/60408081387.pdf
- https://bohemiamaestro.com/webpagebuilder/ckfinder/userfiles/files/pijakupovegolemulorune.pdf
- https://nutritie-metabolism-sanatate.ro/app/webroot/files/userfiles/files/kanopegife.pdf
- http://sugarfree-gelato.com/upload/file/pebanuredu.pdf
- http://carneslaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/3454669251.pdf
- https://jeneifogaszat.hu/cikkdata/files/6402091429.pdf
- https://snowcat.pl/admin/ckfinder/userfiles/files/17726761615.pdf
- http://goldendoodlesofthesierranevadas.com/userfiles/file/kutevubikuzovagon.pdf
- https://safe-international.com/userfiles/file/64070327936.pdf
- http://www.kreasoft.mx/wp-content/plugins/formcraft/file-upload/server/content/files/16139b476e1251---29650452493.pdf
- https://mamotato.ro/userfiles/file/36529699636.pdf
- https://bomnuocebara.com/quangbasanpham/app/webroot/upload/image/files/15747448554.pdf
- http://hokkaido-love87.com/app/webroot/js/ckfinder/userfiles/files/lojasasemolajajexizobokin.pdf
- https://ijpdua.com/contents/files/38098711026.pdf
- http://copingconversations.com/userfiles/file/47071551264.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- oniceh.ru
- kirmatas.com
- clarkfamilybuilders.com
- daqing-jewelry.com
- tourbusan.net
- vernadoc.com
- www.logistiekverbeteren.nl
- unitedfightalliance.jordanadams.com
- bohemiamaestro.com
- sugarfree-gelato.com
- carneslaw.com
- snowcat.pl
- goldendoodlesofthesierranevadas.com
- safe-international.com
- www.kreasoft.mx
- bomnuocebara.com
- hokkaido-love87.com
- ijpdua.com
- copingconversations.com
- www.w3.org
- purl.org
- ns.adobe.com
- nutritie-metabolism-sanatate.ro
- jeneifogaszat.hu
- mamotato.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report