MALICIOUS — 69942722366.pdf
MALICIOUS — 69942722366.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
b5c796aba00a6d5e329869cdc9785c128bc545d0c3aaa6370ab8b72f61e5cf3f - SHA-1:
bad281b48d9f8700c390ee7bda0658d0c6d49b74 - MD5:
0555fb98251972e6832b3ffa21bbe2e9 - ssdeep:
1536:iBxv0Q7WERWep7kbqAr6yPnLOW8pOGEWt1nQMM33ekMcdqp/:8x0Q7WERWe4qedPnLNGTQvneRGQ - TLSH:
T14537C0F3709BDD5C7AC29B476DFA2168718ADB891036EA51404C768CC97C6BFBD00A90 - Submitted as: 69942722366.pdf
- File type: pdf · Size: 74091 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://novafish.it/userfiles/files/53101751381.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://catamma.ru/uplcv?utm_term=digestive+enzyme+usana+pdf, https://areopag.ru/sites/default/files/uploads/36623944469.pdf, http://waycreon.net/bhaskar/yii/upload/files/53858326098.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://catamma.ru/uplcv?utm_term=digestive+enzyme+usana+pdf
- https://areopag.ru/sites/default/files/uploads/36623944469.pdf
- http://waycreon.net/bhaskar/yii/upload/files/53858326098.pdf
- http://novafish.it/userfiles/files/53101751381.pdf
- http://for-rent-leuven.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607fd29ee5803---36659131934.pdf
- https://www.drserapkagan.com/wp-content/plugins/super-forms/uploads/php/files/bhp3pbk7s7meav8t93fti3l1ie/wuwogu.pdf
- http://www.kzhep.in.ua/wp-content/plugins/super-forms/uploads/php/files/15qjgft8828m82v03rir9d0d85/deporan.pdf
- http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160b456602d706---5940441553.pdf
- https://e-uchebnici.com/img/file/ridasagiwoki.pdf
- https://www.myosiaffiliate.com/199trust/img/file/87763375281.pdf
- http://efeotokiralama.com/Upload/file/konibuwinufolokanizezatiw.pdf
- https://agribusiness.pk/wp-content/plugins/formcraft/file-upload/server/content/files/160e160212f29c---nejodosuzevavemu.pdf
- https://www.acetechnology.co.in/wp-content/plugins/super-forms/uploads/php/files/trenunstbkfcbk59h90t9212rf/sukabe.pdf
- http://fatamorgana.fr/uploads/assets/file/fululovurovolav.pdf
- http://www.julitolaschools.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078a86e6b629---fumuzixutebe.pdf
- https://jamiatulbanat.in/wp-content/plugins/formcraft/file-upload/server/content/files/160ad7279389f5---sabusekitogikeloxikudew.pdf
- https://electrabicycles.pl/app/webroot/uploads/file/16215915181224.pdf
- http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/4b1ae5432fc4977cd139ba676a6151a3/33384248890.pdf
- http://socialsipahi.in/assets/ckfinder/core/connector/php/uploads/files/beralujoxude.pdf
- https://parkettworld.com/upload/files/latotivilotadunijiz.pdf
- https://www.kiteschule-eckernfoerde.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607284f128023---gesewozemin.pdf
- https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/4517jdkvjni7tr3u0fp30noq18/wazoku.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- catamma.ru
- areopag.ru
- waycreon.net
- novafish.it
- for-rent-leuven.com
- www.drserapkagan.com
- www.kzhep.in.ua
- e-uchebnici.com
- www.myosiaffiliate.com
- efeotokiralama.com
- www.acetechnology.co.in
- fatamorgana.fr
- www.julitolaschools.com
- jamiatulbanat.in
- electrabicycles.pl
- chagatea.ru
- socialsipahi.in
- parkettworld.com
- www.kiteschule-eckernfoerde.de
- www.frontierexim.com
- www.w3.org
- purl.org
- ns.adobe.com
- adanateknikservis.web.tr
- agribusiness.pk
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report