MALICIOUS — avengers_theme_trombone_quartet.pdf
MALICIOUS — avengers_theme_trombone_quartet.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c9048e90da24faecba615db19a2096330c7b64f30a3da488aefbb6004e32246d - SHA-1:
e4df64819bcb3233f4c4a00dbbab127292f917eb - MD5:
ceb68bad911b2b2900da78ea4d0a811b - ssdeep:
1536:b5uNO6DmvxOw72h9j9/OrEQ4q68Vz7AdXRsp4afxvUBJ5Zsg:luNHWcw7s/jq6cz7eRsp4aC91 - TLSH:
T1B039D0F313D3DD4C379FAF07ADAA05AA6589C2898031C761454CBB6CC96C1BEBC24A51 - Submitted as: avengers_theme_trombone_quartet.pdf
- File type: pdf · Size: 85021 bytes
- Verdict: malicious (96/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!CEB68BAD911B
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://ravowibosu.pbworks.com/f/45924574150.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://infrive.ru/pbw?utm_term=avengers+theme+trombone+quartet, http://ravowibosu.pbworks.com/f/45924574150.pdf, http://nugewil.pbworks.com/w/file/fetch/144539460/how_to_reset_a_whirlpool_duet_sport_washer.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://infrive.ru/pbw?utm_term=avengers+theme+trombone+quartet
- http://ravowibosu.pbworks.com/f/45924574150.pdf
- http://nugewil.pbworks.com/w/file/fetch/144539460/how_to_reset_a_whirlpool_duet_sport_washer.pdf
- http://dijakezepo.pbworks.com/w/file/fetch/144458160/ode_to_joy_2_remo_drive.pdf
- http://kimotamiju.pbworks.com/w/file/fetch/144528672/7246515180.pdf
- https://uploads.strikinglycdn.com/files/6143f2ff-6199-4cff-8d97-f8d8a5a04cb2/32944337442.pdf
- https://uploads.strikinglycdn.com/files/2b6a5483-b99c-4d24-baab-5057e24e1310/nearest_singer_sewing_machine_repair_shop.pdf
- http://sirazumebow.pbworks.com/w/file/fetch/144544035/mafevozojudodim.pdf
- http://tufukamapaf.pbworks.com/w/file/fetch/144528894/convertitore_da_centesimi_a_minuti.pdf
- https://uploads.strikinglycdn.com/files/5124ce0e-8b5d-43ff-8933-c26a3d04bab1/tajugadobajep.pdf
- http://savavaze.pbworks.com/f/how_hard_is_it_to_burn_3000_calories_a_day.pdf
- http://wufamazajo.pbworks.com/w/file/fetch/144448467/39663975437.pdf
- http://vawijoj.pbworks.com/f/tlcharger_dictionnaire_franais_anglais_gratuit_pour_android.pdf
- https://uploads.strikinglycdn.com/files/51a879d2-fd64-4453-a8d5-db9b38e1a018/can_you_download_thinkorswim_on_ipad.pdf
- https://uploads.strikinglycdn.com/files/a132417e-f307-479a-9099-3dfd0c44711b/63070859287.pdf
- http://zorisomofi.pbworks.com/w/file/fetch/144546174/dungeons_and_dragons_players_handbook_5th_edition.pdf
- http://tezalef.pbworks.com/f/how_to_find_dipole_moment_of_a_molecule.pdf
- http://zekodunu.pbworks.com/f/download_any_video_converter_professional_free_full_version.pdf
- http://zupelapowi.pbworks.com/w/file/fetch/144499455/a_grain_of_wheat_summary_and_analysis.pdf
- http://mujefapufefi.pbworks.com/w/file/fetch/144515955/8151865614.pdf
- http://fadoposapat.pbworks.com/w/file/fetch/144476691/what_are_some_british_cuss_words.pdf
- http://rujuboxu.pbworks.com/w/file/fetch/144440109/78981493195.pdf
- https://uploads.strikinglycdn.com/files/be3c2449-10ac-49d3-8dbb-98a2a12f104c/garmin_gns_430_installation.pdf
- https://uploads.strikinglycdn.com/files/c2aeba60-4c2a-4719-a96c-9fb8c22be62e/89263113264.pdf
- https://uploads.strikinglycdn.com/files/e9f8d679-2bd3-40ed-bda5-4c69c89f7a50/how_does_pump_float_switch_work.pdf
Embedded domains
- infrive.ru
- ravowibosu.pbworks.com
- nugewil.pbworks.com
- dijakezepo.pbworks.com
- kimotamiju.pbworks.com
- uploads.strikinglycdn.com
- sirazumebow.pbworks.com
- tufukamapaf.pbworks.com
- savavaze.pbworks.com
- wufamazajo.pbworks.com
- vawijoj.pbworks.com
- zorisomofi.pbworks.com
- tezalef.pbworks.com
- zekodunu.pbworks.com
- zupelapowi.pbworks.com
- mujefapufefi.pbworks.com
- fadoposapat.pbworks.com
- rujuboxu.pbworks.com
- wenitat.pbworks.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report