MALICIOUS — najofed.pdf
MALICIOUS — najofed.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c6650c436497ae93ce9e8a0f89f2015fdfaf2e1c97f037bd091232c51b88ad87 - SHA-1:
15a20d18138c08b7fabe4374624e182b8e0b2388 - MD5:
b5407532e59eb6bb290f9a28eae9a893 - ssdeep:
1536:p9oC70TR0x8DlE6/ZV/Y5/fj7ENx326n7ww6UVIWYpO2FpiwWaxoQ1WNkpVQVkEL:32eWO6/r/Ylfj7E32w0wf2FpdWaqQsgQ - TLSH:
T19F37CFF310ABCD8C769E9F0779A715ADA086DB8D21A3DA9140C8B72C857C5BE7E10601 - Submitted as: najofed.pdf
- File type: pdf · Size: 75815 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://kasintorn.com/images/upload/files/lofegir.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://eksiliotomotiv.com/upload/ckfinder/files/30977358772.pdf, http://jnejendomsdrift.dk/userfiles/file/xevupomifupodor.pdf, http://progfin.pl/userfiles/file/92156962203.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=reading+comprehension+with+vocabulary+worksheets+pdf
- https://eksiliotomotiv.com/upload/ckfinder/files/30977358772.pdf
- http://jnejendomsdrift.dk/userfiles/file/xevupomifupodor.pdf
- http://progfin.pl/userfiles/file/92156962203.pdf
- http://plaschke-partner.com/uploaded/file/24632467953.pdf
- http://kasintorn.com/images/upload/files/lofegir.pdf
- https://livres-d-art.com/ckfinder/userfiles/files/kiditijafakorutaz.pdf
- https://medtek.vn/storage/file/naxefiwaxedel.pdf
- https://gjbuyerbroker.com/userfiles/file/volotixepalebe.pdf
- https://jf-orvalho.pt/userfiles/file/kafotalununemepu.pdf
- https://oasis-travel.ro/files/sufilujodagel.pdf
- https://gauravkankariya.com/wp-content/plugins/super-forms/uploads/php/files/b4949c49cabc9c763f944c7331aa03dc/temuwetolomadusuwonofuz.pdf
- http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/8auo9224es30bns5glvn9at9d1/wadibakogixit.pdf
- https://dancleland.com/img/upload/file/veladudodiputapot.pdf
- https://stcatherine.ac.ug/wp-content/plugins/formcraft/file-upload/server/content/files/16137838719188---2793400150.pdf
- http://tuecpa.com/file_media/file_image/file/44958910525.pdf
- http://ahkjt.com/upfile/file/98568569171.pdf
- http://odontotecnicacoop.it/userfiles/file/20551736223.pdf
- http://55pluscommunityspecialist.com/userfiles/files/71932008159.pdf
- https://evergreencans.com/userfiles/file/saboriwowogufezopelufamu.pdf
- https://moveo-sport.pl/userfiles/file/pegutivegesedob.pdf
- http://ageddfjtj.pretty-match.com/upload/files/kilogipu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- feedproxy.google.com
- eksiliotomotiv.com
- progfin.pl
- plaschke-partner.com
- kasintorn.com
- livres-d-art.com
- gjbuyerbroker.com
- gauravkankariya.com
- dancleland.com
- tuecpa.com
- ahkjt.com
- odontotecnicacoop.it
- 55pluscommunityspecialist.com
- evergreencans.com
- moveo-sport.pl
- ageddfjtj.pretty-match.com
- www.w3.org
- purl.org
- ns.adobe.com
- jnejendomsdrift.dk
- medtek.vn
- jf-orvalho.pt
- oasis-travel.ro
- www.sunaryem.com.tr
- stcatherine.ac.ug
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report