MALICIOUS — a59130_07d48ac1a6094b94a2205059ab013182.pdf

MALICIOUS — a59130_07d48ac1a6094b94a2205059ab013182.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: abc8d9b40e73ce9abdab21d4adcad9455e69229ba1e3ff75d4717f855feae88e
SHA-1: e2f4fc958c34323f056ac3bcef9f7a92840c03b8
MD5: 4a56aa3fea49c84afa2527cb03613074
ssdeep: 1536:EFerlbeVjrFPS4HGTk8fr4Kok9jm5i9lA4kW31fnpg1a5pil9PEtqb6I:7RAxH4BrMF0ca1fG1+SPEti
TLSH: T17C38E0F3A067ED8C768D5B832E6705557496CBC8A532D2400899BBAD843C3BE7F20E51
Submitted as: a59130_07d48ac1a6094b94a2205059ab013182.pdf
File type: pdf · Size: 79194 bytes
Verdict: malicious (96/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!4A56AA3FEA49
Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4393022/normal_5ff15f415f2fb.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://maypoin.ru/wix?keyword=one+piece+treasure+cruise+apk, https://miwebuzoz.weebly.com/uploads/1/3/4/0/134095964/3339233.pdf, https://static.s123-cdn-static.com/uploads/4393022/normal_5ff15f415f2fb.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://maypoin.ru/wix?keyword=one+piece+treasure+cruise+apk
https://miwebuzoz.weebly.com/uploads/1/3/4/0/134095964/3339233.pdf
https://static.s123-cdn-static.com/uploads/4393022/normal_5ff15f415f2fb.pdf
https://juxusuvib.weebly.com/uploads/1/3/0/7/130739690/vujuv.pdf
http://rimka.xyz/bedolasumekekizeliiy8lx.pdf
https://s3.amazonaws.com/benubapopikaj/80142277130.pdf
http://wekeb.space/65342504537fnk4f.pdf
https://s3.amazonaws.com/mejifavo/20642359716.pdf
https://vivuguduwidu.weebly.com/uploads/1/3/2/6/132681484/2994905.pdf
http://italywow.space/youtube_consider_phlebas_audiobookl45zz.pdf
http://natikolom.site/7435431384x2h2n.pdf
https://vinetiwufo.weebly.com/uploads/1/3/5/3/135305890/157602f5.pdf
https://puzomukasudugun.weebly.com/uploads/1/3/4/8/134865935/4256459.pdf
https://s3.amazonaws.com/gozilum/civil_wedding_ceremony_booklet_template.pdf
https://xopozutafedas.weebly.com/uploads/1/3/1/4/131453480/megowoguna.pdf
http://runmasten.online/41055750411ya9ng.pdf
https://s3.amazonaws.com/wiwamoxamo/electric_renewable_energy_systems.pdf
http://driveformclanemilwaukee.com/vexotujisodikowanokimenomibgv0.pdf
https://sonefexezeripu.weebly.com/uploads/1/3/0/7/130739000/39f04a2c6e8.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

maypoin.ru
miwebuzoz.weebly.com
static.s123-cdn-static.com
juxusuvib.weebly.com
rimka.xyz
s3.amazonaws.com
wekeb.space
vivuguduwidu.weebly.com
italywow.space
natikolom.site
vinetiwufo.weebly.com
puzomukasudugun.weebly.com
xopozutafedas.weebly.com
runmasten.online
driveformclanemilwaukee.com
sonefexezeripu.weebly.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report