MALICIOUS — abcaf0a527319e627dd18eda25a35b1c917ca0a37074a7992b8488ebf396f00e
MALICIOUS — abcaf0a527319e627dd18eda25a35b1c917ca0a37074a7992b8488ebf396f00e is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
abcaf0a527319e627dd18eda25a35b1c917ca0a37074a7992b8488ebf396f00e - SHA-1:
15c848568cb79c7e89c74e069f70b1990fb31319 - MD5:
58f2b62a2bb40a41cf570276f9b56e9d - ssdeep:
1536:4Kx+OyTqrS+VKyB2pQwKvSeFymrbNLDBWP08TN003q/WcpOmrDf:fx+VTR+t2pQzvSmymdLQHTN00aOmP - TLSH:
T13237BFF320A7DD9C765B9F03A9E6519C904EE3883262EB505484B77C85BC5BEBF00A50 - Submitted as: abcaf0a527319e627dd18eda25a35b1c917ca0a37074a7992b8488ebf396f00e
- File type: pdf · Size: 72527 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://www.roosprommenschenckelfoundation.nl/ckfinder/files/files/metafagifajoravukexus.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: http://grandfiltr.com/files/file/11775648630.pdf, http://keralastatetailorsassociation.com/userfiles/file/26265634134.pdf, https://dveropolis.ru/upload_picture/19032040900.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=navy+tugboat+for+sale
- http://grandfiltr.com/files/file/11775648630.pdf
- http://keralastatetailorsassociation.com/userfiles/file/26265634134.pdf
- https://dveropolis.ru/upload_picture/19032040900.pdf
- http://benthanhsgfarm.net/images/uploads/files/31548586426.pdf
- http://cga82.com/admin/File/23460739991.pdf
- http://telesson.net/_UploadFile/Images/file/80388064300.pdf
- http://www.museopizarra.com/ckfinder/userfiles/files/53365021066.pdf
- http://www.roosprommenschenckelfoundation.nl/ckfinder/files/files/metafagifajoravukexus.pdf
- http://restravel.ru/ckfinder/userfiles/files/41222865792.pdf
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16158b313cd3f9---wivuwot.pdf
- http://mytrangroup.com/uploads/userfiles/file/33916230493.pdf
- http://tsg-edinstvo.ru/userfiles/file/kuwujujowakividorufane.pdf
- http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/16139c57e92850---tosubiforam.pdf
- http://huichem.com/ckfinder/userfiles/files/16503803367.pdf
- https://baigiangtoanhoc.com/upload/files/14254282417.pdf
- http://baltic-rt.ru/ckfinder/userfiles/files/61065051016.pdf
- http://vamaconsulting.sk/userfiles/file/dadilapanadirutejovunedij.pdf
- http://dealershop.es/camarasegovia/userfiles/file/nunelutuxula.pdf
- http://sameiroeventos.pt/ficheiros/dodemovedarogodazipu.pdf
- https://halkapsikoloji.com/userfiles/file/kifako.pdf
- http://xn--jt2b56wn0ap2a.com/upload/file/202110011123358234.pdf
- http://mmprogetti.it/userfiles/files/sepuvijafubupexajisux.pdf
- http://thibangoto.com/app/webroot/uploads/files/70152491176.pdf
- http://strandedtattoo.com/file/sarozuwuraso.pdf
Embedded domains
- feedproxy.google.com
- grandfiltr.com
- keralastatetailorsassociation.com
- dveropolis.ru
- benthanhsgfarm.net
- cga82.com
- telesson.net
- www.museopizarra.com
- www.roosprommenschenckelfoundation.nl
- restravel.ru
- www.1000ena.com
- mytrangroup.com
- tsg-edinstvo.ru
- www.colegiometa.net
- huichem.com
- baigiangtoanhoc.com
- baltic-rt.ru
- dealershop.es
- halkapsikoloji.com
- xn--jt2b56wn0ap2a.com
- mmprogetti.it
- thibangoto.com
- strandedtattoo.com
- paymentor.nl
- www.w3.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report