MALICIOUS — tovikarejajip.pdf

MALICIOUS — tovikarejajip.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: bde8412f61d6168489e6499ac4d3e780a493edd9c1d77bae8e167f824736dbe6
• SHA-1: 440d43c4799ad7aabde6d386905a1e40dda88fe5
• MD5: 730653c7b4033b0e09723494fecdbacc
• ssdeep: 1536:EGfrjPQndj8bZ91Zi/dj1O582/dihXXwImvHFIVqcp5R2OniBdt3ibC+IwrZHunk:bjYR899OBhOIVqcp5A4MCZOnk
• TLSH: T1BE38DFF36267ED9C74CBEB03BEEA549871D1E248B026C7509584B69CC078BED2E54E40
• Submitted as: tovikarejajip.pdf
• File type: pdf · Size: 80126 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc7879b8b9e860b7b217c01/t/5fc934dc770c1f22ae350710/1607021789865/fever_basketball_aau.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffmen.ru/wb?keyword=freddie%20mac%20student%20loan%20payment%20guidelines, https://static1.squarespace.com/static/5fc7879b8b9e860b7b217c01/t/5fc934dc770c1f22ae350710/1607021789865/fever_basketball_aau.pdf, https://static1.squarespace.com/static/5fc5180827a199023ad07c53/t/5fca664321b8120a24f56809/1607099972488/42727713116.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffmen.ru/wb?keyword=freddie%20mac%20student%20loan%20payment%20guidelines
• https://static1.squarespace.com/static/5fc7879b8b9e860b7b217c01/t/5fc934dc770c1f22ae350710/1607021789865/fever_basketball_aau.pdf
• https://static1.squarespace.com/static/5fc5180827a199023ad07c53/t/5fca664321b8120a24f56809/1607099972488/42727713116.pdf
• https://static1.squarespace.com/static/5fc5b413ff13940aa260656e/t/5fd1466a24bc897ab655a9f3/1607550570639/continuous_slap_sound_effect_download.pdf
• https://uploads.strikinglycdn.com/files/23999236-7c4b-49d6-85b5-f07a0e8c6aaf/56907720496.pdf
• https://uploads.strikinglycdn.com/files/8809220c-13d9-4802-b614-79e6bcc8962f/wufabafaremewuvinivakij.pdf
• https://uploads.strikinglycdn.com/files/3ea60e46-1a84-47ee-a7d2-3369f9e77626/ritififusasovonerofelupe.pdf
• https://static1.squarespace.com/static/5fc5587827a199023ad2f44a/t/5fc8ead8ef56e05e5fab01f9/1607002841822/56971019111.pdf
• https://uploads.strikinglycdn.com/files/27155734-c8f6-43b9-8a89-dba00dd978a1/18khatrimaza_hollywood_movies_in_hindi_a_to_z_720p.pdf
• https://uploads.strikinglycdn.com/files/d8eed74a-e949-4388-8fee-3c4bfc283e3e/how_to_find_absolute_extrema_on_ti_84.pdf
• https://static1.squarespace.com/static/5fc788c9791da6493f6aea64/t/5fcc60606f0099009e5a4195/1607229536792/94852698927.pdf
• https://static1.squarespace.com/static/5fc72d5643c5ee75bf2ae53d/t/5fcd871483d2ac65cc2b5a0c/1607304982043/who_dies_in_the_100_season_6.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5a03bc819f1cf4cfce6b/1606375940017/caravaneer_2_map.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf2114e98326c02d53c9b/1606283793693/vibrating_foot_massager_with_heat.pdf
• https://uploads.strikinglycdn.com/files/d96a0d17-528f-45f4-930e-c867b56b5a47/28233322907.pdf
• https://uploads.strikinglycdn.com/files/ee8e29cf-81c6-4317-8ae1-bfdd39c18860/vixavegokolitizavajot.pdf
• https://static1.squarespace.com/static/5fc578f6405d5340f3488c89/t/5fd1b389ebc7ce75e8b080cb/1607578505051/31354285158.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• static1.squarespace.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report