MALICIOUS — 224978.pdf
MALICIOUS — 224978.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ab096c0a236be07e55b3f0d0e93d9d11afc3a87d2f05a4ee9cef44e853a58c06 - SHA-1:
3493a4414f7d206696ca1066ab43c30708e6aa6e - MD5:
296defbdec2e9b30a76b61ca94e200df - ssdeep:
1536:tx3LtyqSgPMh3cQfzrZ5sS57FAWEOa7hu8QvvZF6eBKMYqrq5Q0Ha1Dl7DJw4:LbtyzgEhsoHb57avBUOeBsyqzH4D9D1 - TLSH:
T1B638D0F75057DD4CBA4B8B236CF629E9359FC3D83231ABA04488AB5C866C5AE2D00D51 - Submitted as: 224978.pdf
- File type: pdf · Size: 82090 bytes
- Verdict: malicious (96/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!296DEFBDEC2E
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4365553/normal_5fe092482d2d6.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://druttle.ru/wb?keyword=download%20photoshop%20gimp%20gratis%20italiano, https://uploads.strikinglycdn.com/files/4cb3b6b5-4134-458d-a795-a9c1c09107f1/nufunekikapipozoxuwako.pdf, http://kojazunupetip.mygamesonline.org/4531659440.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://druttle.ru/wb?keyword=download%20photoshop%20gimp%20gratis%20italiano
- https://uploads.strikinglycdn.com/files/4cb3b6b5-4134-458d-a795-a9c1c09107f1/nufunekikapipozoxuwako.pdf
- http://kojazunupetip.mygamesonline.org/4531659440.pdf
- https://s3.amazonaws.com/jemisajoda/rigirirovagoponufezud.pdf
- https://cdn-cms.f-static.net/uploads/4427077/normal_603152aa0b4c9.pdf
- https://uploads.strikinglycdn.com/files/79372ed6-6a8e-4661-be48-57d67e97e084/what_is_f21_on_a_whirlpool_duet.pdf
- https://uploads.strikinglycdn.com/files/1a2831bf-36bc-4adc-9b63-ddbf17dd1c9a/xigijawam.pdf
- https://cdn-cms.f-static.net/uploads/4403260/normal_60176e8816dad.pdf
- https://uploads.strikinglycdn.com/files/77c3cc00-e0e5-408b-92c2-5d1cbd4b0962/on_the_road_truck_simulator_ps4_date_de_sortie.pdf
- http://nevinidonet.mywebcommunity.org/kosowapa.pdf
- https://static.s123-cdn-static.com/uploads/4365553/normal_5fe092482d2d6.pdf
- https://uploads.strikinglycdn.com/files/5c1a1e45-6651-425b-857d-f30125d28016/sufusimiwekamemilosimuwew.pdf
- http://lunatan.medianewsonline.com/what_size_labels_dymo_450.pdf
- https://cdn-cms.f-static.net/uploads/4446045/normal_601adea323b34.pdf
- http://zakosemej.mypressonline.com/what_does_college_and_career_readiness_mean.pdf
- https://s3.amazonaws.com/zikeko/wikizofe.pdf
- https://static.s123-cdn-static.com/uploads/4451363/normal_5fce917e2f733.pdf
- https://static.s123-cdn-static.com/uploads/4387412/normal_5ff4630785d16.pdf
- https://static.s123-cdn-static.com/uploads/4444377/normal_5ffe1ad2ed59a.pdf
- https://uploads.strikinglycdn.com/files/608358d6-7565-453d-9aeb-58fe09fda135/pemupelu.pdf
- http://gifidabula.atwebpages.com/what_can_i_eat_high_fat_low_carb.pdf
- https://s3.amazonaws.com/pubopelej/61645613087.pdf
- https://uploads.strikinglycdn.com/files/719d9740-17c0-446b-aadc-3dea3e0d965b/making_venn_diagram_in_powerpoint.pdf
- https://uploads.strikinglycdn.com/files/facdf311-bd56-4164-8423-deca007f9615/17267231204.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- druttle.ru
- uploads.strikinglycdn.com
- kojazunupetip.mygamesonline.org
- s3.amazonaws.com
- cdn-cms.f-static.net
- nevinidonet.mywebcommunity.org
- static.s123-cdn-static.com
- lunatan.medianewsonline.com
- zakosemej.mypressonline.com
- gifidabula.atwebpages.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report