MALICIOUS — 1abc29_405448e4b9084ca4be4ba7e83f77f7cb.pdf
MALICIOUS — 1abc29_405448e4b9084ca4be4ba7e83f77f7cb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
b2f2aaae5435e68000deb64f4a214b3e0dc62e03ed67cb87063352ddf88f7a3f - SHA-1:
077b25b81c02dcba2190cc950eaeebfada075259 - MD5:
227cbf1150440ea05ab0165ab42e3492 - ssdeep:
1536:uFSH+EkSQvwWFuocPJuEOiWyPRGdu0pzeSCVHqk/feX/LDEDzzV:reEavVu0EhLpOyZVHLeXHEDt - TLSH:
T1A038D0F36117CDDDBAC66B5378E315556885C3986032DF5064C8BAACC8BC2BD3E60920 - Submitted as: 1abc29_405448e4b9084ca4be4ba7e83f77f7cb.pdf
- File type: pdf · Size: 79700 bytes
- Verdict: malicious (96/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!227CBF115044
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4461207/normal_5fc8c04761193.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://jottigo.ru/wix?keyword=financial+auditing+textbook+pdf, https://cdn-cms.f-static.net/uploads/4463528/normal_60309f7dc7df1.pdf, https://cdn-cms.f-static.net/uploads/4418192/normal_6029500baee9c.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://jottigo.ru/wix?keyword=financial+auditing+textbook+pdf
- https://cdn-cms.f-static.net/uploads/4463528/normal_60309f7dc7df1.pdf
- https://cdn-cms.f-static.net/uploads/4418192/normal_6029500baee9c.pdf
- https://static.s123-cdn-static.com/uploads/4461207/normal_5fc8c04761193.pdf
- http://callipakk2.site/24399669063dw3hc.pdf
- http://leaninrzpd.site/jysk_king_size_bed_sheets4alif.pdf
- http://bitcoins-profits.com/gun_muzzle_flash_effectsm5u6y.pdf
- https://cdn-cms.f-static.net/uploads/4480393/normal_5fd676a9a465d.pdf
- https://static.s123-cdn-static.com/uploads/4476765/normal_60023b1292433.pdf
- https://cdn-cms.f-static.net/uploads/4367640/normal_603076a20f944.pdf
- https://static.s123-cdn-static.com/uploads/4499942/normal_600260e5178db.pdf
- http://reduslim-italiaoficial.site/bagetosurepo7a2hj.pdf
- http://tublitalia.space/goziwegixibut0jsgt.pdf
- http://mmamba.ru/willing_and_nothingness_schopenhauer_as_nietzsches_educatorde10t.pdf
- https://s3.amazonaws.com/vufuzewasi/medicamentos_aines.pdf
- http://palitra-cveta.ru/zebozajapah7lqa.pdf
- http://lnstagram-copyright-supports.com/37690843628x8er1.pdf
- https://static.s123-cdn-static.com/uploads/4416304/normal_5fde92c219b1f.pdf
- http://reactivaperu-2020.com/viduvonofadezivokaiio28.pdf
- http://excschool.ru/73820036142epi7w.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- jottigo.ru
- cdn-cms.f-static.net
- static.s123-cdn-static.com
- callipakk2.site
- leaninrzpd.site
- bitcoins-profits.com
- reduslim-italiaoficial.site
- tublitalia.space
- mmamba.ru
- s3.amazonaws.com
- palitra-cveta.ru
- lnstagram-copyright-supports.com
- reactivaperu-2020.com
- excschool.ru
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report