MALICIOUS — 27742008617.pdf
MALICIOUS — 27742008617.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
b1e09ba291eae14fa07be8cb47e272b1f96860ecb7eb473f36bc3a8635e73900 - SHA-1:
ca845ad635507b7d61cf88e221c258fcd09ff385 - MD5:
6bd3ad4a6ab5f582b09ce50560b78486 - ssdeep:
1536:bkmdslHV6B96U72IK7xLZBARGpxVGLWOpOaZEWpewCxKLX:rmNL7xLZBARGpn9aZVKg - TLSH:
T15C37C0F371D7DD8C778B9F036DA6526CA04AD384117296A48048BB7C44BCAFDBB10A51 - Submitted as: 27742008617.pdf
- File type: pdf · Size: 69958 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://syntra.pl/userfiles/file/gugaxe.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://synerhu.ru/uplcv?utm_term=bingo+blitz+cheats+android, http://syntra.pl/userfiles/file/gugaxe.pdf, http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615098b87813c---gisesirolozazu.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://synerhu.ru/uplcv?utm_term=bingo+blitz+cheats+android
- http://syntra.pl/userfiles/file/gugaxe.pdf
- http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615098b87813c---gisesirolozazu.pdf
- http://itineraire-consulting.com/ckfinder/userfiles/files/91380549782.pdf
- https://ptogel2.com/contents/files/7305959719.pdf
- http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1613fce7ddb927---12375608769.pdf
- https://rumahbaruku.com/contents/files/55016182767.pdf
- http://bestapp4u.com/admin/uploadedfiles/file/39226819834.pdf
- http://graylegalservices.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/vogisudurivabirakuma.pdf
- http://vaithun.net/upload/files/wadixorar.pdf
- http://alphasigmaoverseas.com/userfiles/file/tegovumusufigafutusis.pdf
- https://rimsball.com/ckfinder/userfiles/files/58060691741.pdf
- https://floresdeserrezuela.com/aym_image/files/49651532657.pdf
- http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16152dcbaed219---95068101209.pdf
- http://potya.com/41706846121.pdf
- https://www.nobleorthodontic.com/wp-content/plugins/super-forms/uploads/php/files/82d3a037ec872be71820334de98e02a7/25032936499.pdf
- http://andrelandberg.com/userfiles/file/76567988324.pdf
- https://matkinhantai.com/luutru/files/2117609077.pdf
- https://zevkotodoseme.com/upload/ckfinder/files/dodaboketuzotuz.pdf
- https://limblength-sldf.com/userfiles/file/xizebevusiwudokenomixe.pdf
- http://www.garriagricola.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613a7dc5b4cbe---24587956288.pdf
- https://www.jakketoes.be/ckfinder/userfiles/files/tawagekipolazenuri.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- synerhu.ru
- syntra.pl
- www.stratcareerservices.com
- itineraire-consulting.com
- ptogel2.com
- totalfinance.ca
- rumahbaruku.com
- bestapp4u.com
- graylegalservices.com
- vaithun.net
- alphasigmaoverseas.com
- rimsball.com
- floresdeserrezuela.com
- luckyassessoria.com.br
- potya.com
- www.nobleorthodontic.com
- andrelandberg.com
- matkinhantai.com
- zevkotodoseme.com
- limblength-sldf.com
- www.garriagricola.com
- www.jakketoes.be
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report