MALICIOUS — a61b5da4acb257af0c5e50f024acfd50b5bebcdcec2a7de7efd5d51e64cd071b
MALICIOUS — a61b5da4acb257af0c5e50f024acfd50b5bebcdcec2a7de7efd5d51e64cd071b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a61b5da4acb257af0c5e50f024acfd50b5bebcdcec2a7de7efd5d51e64cd071b - SHA-1:
6fe561c79ceb7c4ea3f7d12d662764e21e2d6487 - MD5:
ffc432141d88ffda4b2ada25ecedf280 - ssdeep:
1536:pZsfGVeQIVNwhJdDcGuUoHC9FhxL8oHXWdeWHTD4lK1EoW498:Hs27JhJZeC9FjL7GdB4k1EoW4G - TLSH:
T1BA37E0F30193ED2C7A9E0F039DAA126E98AAE74890A3E581158C2768D0FC7FD7D50507 - Submitted as: a61b5da4acb257af0c5e50f024acfd50b5bebcdcec2a7de7efd5d51e64cd071b
- File type: pdf · Size: 73135 bytes
- Verdict: malicious (94/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://kachhiproperties.com/wp-content/plugins/super-forms/uploads/php/files/c077e859c0fc58f97df15ddfe027bdce/9978745924.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: http://abwbaltimore.com/uploads/files/3153564777.pdf, http://agro-pasz.pl/ckfinder/userfiles/files/77893662592.pdf, http://hybsch.it/upload/file/38940338968.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=little+brown+curly+hair+dog
- http://abwbaltimore.com/uploads/files/3153564777.pdf
- http://agro-pasz.pl/ckfinder/userfiles/files/77893662592.pdf
- http://hybsch.it/upload/file/38940338968.pdf
- http://elitvorota.ru/f/file/14434445292.pdf
- https://kachhiproperties.com/wp-content/plugins/super-forms/uploads/php/files/c077e859c0fc58f97df15ddfe027bdce/9978745924.pdf
- http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c05484be62---72390666393.pdf
- http://files.ibiza-ferien.de/file/28075644445.pdf
- http://www.verneteco.com/ckfinder/userfiles/files/tabanoxerodofegojopapi.pdf
- http://naim.naparts.com/images/fck/file/zuburubured.pdf
- http://career-id.org/ckfinder/userfiles/files/pejuvig.pdf
- http://gyermekhaz.hu/Content/site_images/files/40288431891.pdf
- http://jyjwqj.com/uploadfile/file///2021091706005698.pdf
- https://lrdreamteam.com/files/files/file/InfoProduct/file/56702609600.pdf
- http://motoren-adachi.com/js/upload/files/wovuja.pdf
- https://westhigienia.hu/editor_up/60861148393.pdf
- https://fnb-concepts.com/images/uploads/files/dezigin.pdf
- http://na-bytecek.cz/UserFiles/File/judonewe.pdf
- https://www.bluegreenshouseboats.in/wp-content/plugins/formcraft/file-upload/server/content/files/1615b50ec81337---51628624800.pdf
- http://hanlacsclub.com/ckupload/files/58984098962.pdf
- https://maturana.cl/upload/file/78041845445.pdf
- http://technoprofile.ru/userfiles/file/63501186444.pdf
- http://detskaoptika.cz/ckfinder/userfiles/files/98251970447.pdf
- https://pezenasenchantee.fr/userfiles/file/porawijes.pdf
Embedded domains
- feedproxy.google.com
- abwbaltimore.com
- agro-pasz.pl
- hybsch.it
- elitvorota.ru
- kachhiproperties.com
- www.sarajevo-inn-grunewald.com
- files.ibiza-ferien.de
- www.verneteco.com
- naim.naparts.com
- career-id.org
- jyjwqj.com
- lrdreamteam.com
- motoren-adachi.com
- fnb-concepts.com
- www.bluegreenshouseboats.in
- hanlacsclub.com
- technoprofile.ru
- pezenasenchantee.fr
- gyermekhaz.hu
- westhigienia.hu
- na-bytecek.cz
- maturana.cl
- detskaoptika.cz
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report