MALICIOUS — cca3b2558085c3b1e54084683326a84e2da838ff20ce8f68b123f2d661b46536
MALICIOUS — cca3b2558085c3b1e54084683326a84e2da838ff20ce8f68b123f2d661b46536 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
cca3b2558085c3b1e54084683326a84e2da838ff20ce8f68b123f2d661b46536 - SHA-1:
eed580be132513be19dcaac44ba8053bd5053047 - MD5:
0172d103231da978d32ae4177a1702ee - ssdeep:
1536:0HpkUSYy2NFq50w7alxWkOZB0s4lGdxm9jnc3hcEN8jpG+R3nBTjXYffeEW9olu4:skURgtaacnkd+jc3hGjI+VBXY3eWRxpH - TLSH:
T19939C0F3619BCE4C778BAF03796A51ACA046E74D2412EB504488FB3CD57CA7DAE10921 - Submitted as: cca3b2558085c3b1e54084683326a84e2da838ff20ce8f68b123f2d661b46536
- File type: pdf · Size: 85592 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://dlzhrjd.com/images/uploadfile/files/walawamelujetovepa.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://medvor.ru/uplcv?utm_term=check+model+by+vin, http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1614b1e435d256---nijugakifisigotosudenat.pdf, http://dlzhrjd.com/images/uploadfile/files/walawamelujetovepa.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://medvor.ru/uplcv?utm_term=check+model+by+vin
- http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1614b1e435d256---nijugakifisigotosudenat.pdf
- http://dlzhrjd.com/images/uploadfile/files/walawamelujetovepa.pdf
- http://hulstcustoms.ru/uploads/files/rafajajebenusojazulube.pdf
- http://gemaeldeundobjekte.de/uploads/files/zevulifula.pdf
- https://inprovitecuador.com/ckfinder/userfiles/files/birojidez.pdf
- https://lee-trading.tw/archive/upload/files/33462891259.pdf
- https://tyko.pl/userfiles/file/26012201328.pdf
- http://old.arcnet.org.tw/ckfinder/userfiles/files/91063846825.pdf
- http://smithmurdock.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136fc2026bf4---sonumukedazetafewujozumo.pdf
- http://booklandbooks.com/userfiles/file/96706653083.pdf
- https://www.bouwenaaneensterkwerkgeversmerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161636a080b4bd---kodivuner.pdf
- http://ahzycw.com/upload_fck/file/2021-10-6/20211006055230175507.pdf
- http://safaraval.com/basefile/safaravalcom/files/vulagalafapu.pdf
- http://entone.es/wp-content/plugins/super-forms/uploads/php/files/de0ed5ff67df877cb01cc32d5989ec3d/bulizowu.pdf
- https://masterok-kovka.ru/wp-content/plugins/super-forms/uploads/php/files/9e177250ef908956980b1c57fadd824b/14765742188.pdf
- https://zivotzaokny.eu/res/file/57157838223.pdf
- http://actybrain-consult.com/Upload/files/78615220550.pdf
- http://akafgdsgreawy.pretty-match.com/upload/files/86375879922.pdf
- http://hklh.vip/data/attachment/file/boxujarij.pdf
- http://parikshitconstruction.com/uploads/vurenekigubamovezufesux.pdf
- http://redondoclassicburger.com/uploads/files/14446354005.pdf
- http://www.restorationservice.ca/wp-content/plugins/formcraft/file-upload/server/content/files/161510c2ecaf48---sunikojulazo.pdf
- https://kaptenhoki.org/contents/files/10933977210.pdf
- https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/29e54af21e0d120b7507a0fcaca7d6ad/juzuzonesavo.pdf
Embedded domains
- medvor.ru
- totalfinance.ca
- dlzhrjd.com
- hulstcustoms.ru
- gemaeldeundobjekte.de
- inprovitecuador.com
- lee-trading.tw
- tyko.pl
- old.arcnet.org.tw
- smithmurdock.com
- booklandbooks.com
- www.bouwenaaneensterkwerkgeversmerk.nl
- ahzycw.com
- safaraval.com
- entone.es
- masterok-kovka.ru
- zivotzaokny.eu
- actybrain-consult.com
- akafgdsgreawy.pretty-match.com
- hklh.vip
- parikshitconstruction.com
- redondoclassicburger.com
- www.restorationservice.ca
- kaptenhoki.org
- qboardapp.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report