MALICIOUS — 80bfa9_f25c0392a5bb4554909b7632ca2fe08c.pdf

MALICIOUS — 80bfa9_f25c0392a5bb4554909b7632ca2fe08c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: a85d5e3536c3e2e9f730a914639f401a518c8fad527971a8b6b186042a9c51c0
• SHA-1: 4cc5deace4e2e96ba2d3e83ff785299a8a9b5886
• MD5: 0a7a1abaa0c21a861042bb8f43fc171e
• ssdeep: 1536:3jRaV4GR3CSISvrrYa63t0j7LYb6shtipxatI6gAifOiPw5d:Ez5pvrMa63t0Lc7cSgAi2i4H
• TLSH: T1633BF1E7715BDD0C76A99B03BAA7066CB449C1C83132DBA158C4367CD5AC5AE7D30E20
• Submitted as: 80bfa9_f25c0392a5bb4554909b7632ca2fe08c.pdf
• File type: pdf · Size: 106186 bytes
• Verdict: malicious (97/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded link rated suspicious by URL analysis: https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_778fd0492eee4aedb6a46413587c0d30.pdf?index=true - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://leonvi.ru/wix?keyword=civic+arena+pittsburgh, https://cdn.sqhk.co/zejizoguzut/eidjhie/95211769124.pdf, http://rajokonola.epizy.com/14786470115.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://leonvi.ru/wix?keyword=civic+arena+pittsburgh
• https://cdn.sqhk.co/zejizoguzut/eidjhie/95211769124.pdf
• http://rajokonola.epizy.com/14786470115.pdf
• https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_778fd0492eee4aedb6a46413587c0d30.pdf?index=true
• https://82c1a4a6-0aea-44ab-842b-07cb5bdde860.filesusr.com/ugd/aafee9_c47e3689719c411985978298760214bd.pdf?index=true
• https://4c72699b-aa2e-4dc8-8bd5-1a54e8f938a6.filesusr.com/ugd/f3cb45_029abb1c914344f495491fabdff62c7c.pdf?index=true
• http://japamawosoj.mygamesonline.org/suwulemum.pdf
• https://c46c713f-5e69-4c64-aad4-d86f29440f76.filesusr.com/ugd/957c7b_4f64ba037e164afab38819fea78f31ad.pdf?index=true
• http://zirutabu.myartsonline.com/body_parts_vocabulary_worksheet.pdf
• https://s3.amazonaws.com/dutuzanob/tintin_comics_download.pdf
• http://nevabaza.atwebpages.com/kodemukusoba.pdf
• https://e437b920-fa79-41d5-b67c-0ca059f4e77a.filesusr.com/ugd/d97c10_d897dfafbf4b440f98b59115d2ec2800.pdf?index=true
• https://s3.amazonaws.com/mamukawaxatali/zemapanoxi.pdf
• https://s3.amazonaws.com/fifuto/reloading_store_tulsa.pdf
• https://s3.amazonaws.com/sigobija/vcd_cutter_registered_free.pdf
• https://5a3bb923-6189-432a-a936-48d98632e4cf.filesusr.com/ugd/a86d68_3854da0691564708b9c6bf896037bdd5.pdf?index=true
• https://cdn.sqhk.co/tadeketoxab/dNNZUMg/vitacost_promo_code_2020.pdf
• http://janorewaxeno.mygamesonline.org/9153663173.pdf
• https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_c106627801244a9989320017ac5fb107.pdf?index=true
• http://vebodunusugi.rf.gd/capsim_comp_xm_cheats.pdf
• http://xogunajeraxuda.mywebcommunity.org/analects_of_confucius_chapter_summaries.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• leonvi.ru
• cdn.sqhk.co
• rajokonola.epizy.com
• e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com
• 82c1a4a6-0aea-44ab-842b-07cb5bdde860.filesusr.com
• 4c72699b-aa2e-4dc8-8bd5-1a54e8f938a6.filesusr.com
• japamawosoj.mygamesonline.org
• c46c713f-5e69-4c64-aad4-d86f29440f76.filesusr.com
• zirutabu.myartsonline.com
• s3.amazonaws.com
• nevabaza.atwebpages.com
• e437b920-fa79-41d5-b67c-0ca059f4e77a.filesusr.com
• 5a3bb923-6189-432a-a936-48d98632e4cf.filesusr.com
• janorewaxeno.mygamesonline.org
• c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com
• xogunajeraxuda.mywebcommunity.org
• www.w3.org
• purl.org
• ns.adobe.com
• vebodunusugi.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report