MALICIOUS — 134172_87256761cd4f4b0aa6794ac4c347c94c.pdf
MALICIOUS — 134172_87256761cd4f4b0aa6794ac4c347c94c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
cd441cd481cb7dbaf101e105519eff12a6f6b4e7e74b2f77526730956f413929 - SHA-1:
e06538658c5b416ed9abc971f562e57b1c5af209 - MD5:
0c782b2e97f18b46f37968dfc16120f3 - ssdeep:
1536:IflxR/hisQ4CJxeGgjdaydM2lqomX3jg24iAXWrFBdK4EqJQ1pJsGWHlWakp:ebR/hi7e3jdhG2lqo/iBrndK4VfWb - TLSH:
T1F139D0F3119BDC8CBA455B83AEB30148B98EE7853023BBA18489BA6CC47C67D7F50550 - Submitted as: 134172_87256761cd4f4b0aa6794ac4c347c94c.pdf
- File type: pdf · Size: 87213 bytes
- Verdict: malicious (96/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!0C782B2E97F1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4392462/normal_5ffa7ec9825bb.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://maypoin.ru/wix?keyword=adobe+zii+is+damaged+and+can%2527t+be+opened, https://static.s123-cdn-static.com/uploads/4392462/normal_5ffa7ec9825bb.pdf, https://static.s123-cdn-static.com/uploads/4393515/normal_5ff55b6312ad4.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://maypoin.ru/wix?keyword=adobe+zii+is+damaged+and+can%2527t+be+opened
- https://s3.amazonaws.com/sorogamat/alphabet_espagnol_prononciation.pdf
- https://static.s123-cdn-static.com/uploads/4392462/normal_5ffa7ec9825bb.pdf
- https://static.s123-cdn-static.com/uploads/4393515/normal_5ff55b6312ad4.pdf
- https://s3.amazonaws.com/fonibinaraj/business_letter_format_with_cc_and_attachments.pdf
- https://cdn-cms.f-static.net/uploads/4469143/normal_60325c61e33e2.pdf
- https://cdn-cms.f-static.net/uploads/4425916/normal_5fd0a149e1f6d.pdf
- https://s3.amazonaws.com/wexoteluwag/minecraft_crafting_guide_1._12_1.pdf
- https://static.s123-cdn-static.com/uploads/4369794/normal_5fe41d29e9f24.pdf
- https://s3.amazonaws.com/jivuxo/ropamevuluviv.pdf
- https://s3.amazonaws.com/nonabafat/english_grammar_tenses_exercises_with_answers.pdf
- https://cdn-cms.f-static.net/uploads/4477379/normal_601ef32244138.pdf
- http://befojarariwowab.epizy.com/7437467593.pdf
- https://cdn-cms.f-static.net/uploads/4496014/normal_5fd67c2d3db54.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_602b721194c30.pdf
- https://s3.amazonaws.com/wivunonovef/57774193888.pdf
- https://static.s123-cdn-static.com/uploads/4453889/normal_5fdf427a19cce.pdf
- https://cdn-cms.f-static.net/uploads/4424935/normal_60144e27d7f6e.pdf
- https://static.s123-cdn-static.com/uploads/4423137/normal_5fecc10fc860f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- maypoin.ru
- s3.amazonaws.com
- static.s123-cdn-static.com
- cdn-cms.f-static.net
- befojarariwowab.epizy.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report