MALICIOUS — c0f8b7093279a5405e6f27bde3dbadc1761fc4963a6a19ef67e79ed36b8198bf
MALICIOUS — c0f8b7093279a5405e6f27bde3dbadc1761fc4963a6a19ef67e79ed36b8198bf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c0f8b7093279a5405e6f27bde3dbadc1761fc4963a6a19ef67e79ed36b8198bf - SHA-1:
fba7849e427b090136e2e932e0b04ecefeee4cc2 - MD5:
5b78e2dea410775fc5e33b38e7e5562d - ssdeep:
1536:sjCZ32wVLNbsD//qC90pQCbcmpjaW1D+d9dekWypOlLcdyWMZWEbL1oE9K:r3VNbsD/SCOpQCoI/lLMypjbL1oE9K - TLSH:
T16439E1F3918BDD0C398AAB43B9AB22B6C489D7D87191E05015C4A63C95AC5FEFD10E41 - Submitted as: c0f8b7093279a5405e6f27bde3dbadc1761fc4963a6a19ef67e79ed36b8198bf
- File type: pdf · Size: 88002 bytes
- Verdict: malicious (96/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://adec-interiors.net/Uploads/file/jogogokufatu.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://oniceh.ru/uplcv?utm_term=culture+and+society+as+a+complex+whole+means+it+encompasses+the, http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161466935722e5---90028876950.pdf, https://kvizek.hu/ckfinder/userfiles/files/92411922185.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://oniceh.ru/uplcv?utm_term=culture+and+society+as+a+complex+whole+means+it+encompasses+the
- http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161466935722e5---90028876950.pdf
- https://kvizek.hu/ckfinder/userfiles/files/92411922185.pdf
- https://renteci.com/imagens/file/19979928455.pdf
- http://kurskodkb.ru/page_edit/_samples/userfiles/files/bebojawunoremub.pdf
- http://elliptical-trainers.ru/ckfinder/userfiles/files/jamabaf.pdf
- http://allasclub.com/campannas/file/87809207494.pdf
- http://darec.sk/files/files/kedokevumobuxofov.pdf
- http://adec-interiors.net/Uploads/file/jogogokufatu.pdf
- http://mdtrend.hu/files/file/87646501741.pdf
- http://www.fishandcosolicitors.com/uploads/files/80670585903.pdf
- https://floridainvestment.cz/files/file/zasunep.pdf
- https://jahanchart.ir/data/files/file/52867657452.pdf
- http://ablerexthailand.com/userfiles/files/pikizobetuwumobabev.pdf
- https://www.vibrationmonitoring.asia/wp-content/plugins/formcraft/file-upload/server/content/files/1614d0657ee757---zenenibidudadekisoxowid.pdf
- https://aadharshilaschool.org/userfiles/file/60081206804.pdf
- http://leicesterbiketec.com/userfiles/file/62082832450.pdf
- https://mangonebike.com/uploads/file/72911803827.pdf
- https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/16158a9ff5f721---doxivadapo.pdf
- http://tlw.ro/UserFiles/file/xupupede.pdf
- http://nonstopsushi.com/uploads/files/mokokilusamamemeximeti.pdf
- https://careerroots.net/ckfinder/userfiles/files/ruziwivifurazixure.pdf
Embedded domains
- oniceh.ru
- www.nationaalgolfcongres.nl
- renteci.com
- kurskodkb.ru
- elliptical-trainers.ru
- allasclub.com
- adec-interiors.net
- www.fishandcosolicitors.com
- jahanchart.ir
- ablerexthailand.com
- www.vibrationmonitoring.asia
- aadharshilaschool.org
- leicesterbiketec.com
- mangonebike.com
- inclinedigital.com
- nonstopsushi.com
- careerroots.net
- kvizek.hu
- darec.sk
- mdtrend.hu
- floridainvestment.cz
- tlw.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report