MALICIOUS — 6e6d9ab37a763.pdf

MALICIOUS — 6e6d9ab37a763.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: d0217b7f7fd5fcc572a3623929c54b334f35fc331a23f66323bf7bdb9c2ac0e2
• SHA-1: a4d04913f15af17cae8b32b8a7629ed0f9ad8585
• MD5: 7baa77b90d8383c8787cd68dfb93f80f
• ssdeep: 1536:Ip2whoIdRxQ3IiCQB884hftAIdCNyrgqU0dSmMAHwT5FS1RONtTobXp6uyH3:q4IdRxQQQS8E64y2JU0YmhwT5yRONpIO
• TLSH: T1EA38D0F36157CF4CEB9A9B979DAA2669944AE384713396D048087A2C883C1FF3D50D21
• Submitted as: 6e6d9ab37a763.pdf
• File type: pdf · Size: 78373 bytes
• Verdict: malicious (96/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!7BAA77B90D83
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4455876/normal_5fc7a4d3d3b87.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://baarspo.ru/wb?keyword=mini%20mineral%20water%20plant%20project%20report, https://static.s123-cdn-static.com/uploads/4455876/normal_5fc7a4d3d3b87.pdf, http://starkrobotics.org/religious_education_questions0m1tr.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://baarspo.ru/wb?keyword=mini%20mineral%20water%20plant%20project%20report
• https://s3.amazonaws.com/dutimajizowa/central_and_inscribed_angles_worksheet.pdf
• https://s3.amazonaws.com/fivebo/walden_2_bf_skinner.pdf
• https://static.s123-cdn-static.com/uploads/4455876/normal_5fc7a4d3d3b87.pdf
• https://s3.amazonaws.com/wemupajese/50705293053.pdf
• https://s3.amazonaws.com/mozedijiz/63940989024.pdf
• https://s3.amazonaws.com/jevedijadiki/arrhenius_equation_derivation.pdf
• http://starkrobotics.org/religious_education_questions0m1tr.pdf
• http://springwin.space/80523299571nvgyn.pdf
• http://trixy-matrix.space/dopadafoxopabefopilkve7.pdf
• http://abreudesigns.com/wikezutakixxydly.pdf
• https://s3.amazonaws.com/vikukinumet/dutixiviw.pdf
• https://s3.amazonaws.com/kalanejaxutilif/vujarefajigabopejopakor.pdf
• https://cdn-cms.f-static.net/uploads/4451353/normal_6019f4a85d58a.pdf
• https://cdn-cms.f-static.net/uploads/4497369/normal_5fd88bb35dd49.pdf
• https://s3.amazonaws.com/farezelof/chhattisgarhi_gana_kaise_kare.pdf
• https://s3.amazonaws.com/somamere/tarefokasokaxidadafubon.pdf
• http://shoop-fr.ru/one_block_skyblock_map_1._16._2qk513.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• baarspo.ru
• s3.amazonaws.com
• static.s123-cdn-static.com
• starkrobotics.org
• springwin.space
• trixy-matrix.space
• abreudesigns.com
• cdn-cms.f-static.net
• shoop-fr.ru
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report