MALICIOUS — b74cc294765.pdf
MALICIOUS — b74cc294765.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e301862196a835a5d7d89c753eb056d678a429e9acd588f0db5f0f87433a1ba3 - SHA-1:
83f554d32b05b1a06693d8649450c5a397f211d5 - MD5:
aa8e3d416c3bcdc656e8f16ed4a61155 - ssdeep:
1536:N1N97cFAm5tjEzUfj/RtSaJALEgaeersgWwbnnaIllKz+:TtgqzU7GheIgWcna8lH - TLSH:
T13036D0F361ABDF8C669BAB537DE6251634DEC2881231936488D8B33DC4B817EBD14810 - Submitted as: b74cc294765.pdf
- File type: pdf · Size: 66484 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4383314/normal_5fca5d3fa8011.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=vitalsource%20bookshelf%20import%20pdf, https://static1.squarespace.com/static/5fc54d6ff7cf8c754047e780/t/5fce6bdef94b6402b2505f45/1607363551522/sleep_sounds_ocean_alexa.pdf, https://niweduval.weebly.com/uploads/1/3/4/3/134349673/ratovadifavevuvaz.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=vitalsource%20bookshelf%20import%20pdf
- https://static1.squarespace.com/static/5fc54d6ff7cf8c754047e780/t/5fce6bdef94b6402b2505f45/1607363551522/sleep_sounds_ocean_alexa.pdf
- https://s3.amazonaws.com/kitakilesa/free_promissory_note_template_ontario.pdf
- https://niweduval.weebly.com/uploads/1/3/4/3/134349673/ratovadifavevuvaz.pdf
- https://josudirojupa.weebly.com/uploads/1/3/4/7/134729494/f444dd8.pdf
- https://papizutexoda.weebly.com/uploads/1/3/0/9/130969148/837753.pdf
- https://static.s123-cdn-static.com/uploads/4383314/normal_5fca5d3fa8011.pdf
- https://cdn-cms.f-static.net/uploads/4489257/normal_5fbf21e0627aa.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf6688173fb5383b9a7939/1606379144576/rc_grave_digger_traxxas.pdf
- https://jumolemema.weebly.com/uploads/1/3/4/8/134853288/xejixazu.pdf
- https://vezaxudikofexi.weebly.com/uploads/1/3/4/6/134654587/zibadokosigasaj.pdf
- https://s3.amazonaws.com/xulepiwa/ecommerce_manager_resume_template.pdf
- https://cdn-cms.f-static.net/uploads/4413228/normal_5f96ebfe8d3c4.pdf
- https://folemazilepi.weebly.com/uploads/1/3/1/1/131164248/3431214.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- static1.squarespace.com
- s3.amazonaws.com
- niweduval.weebly.com
- josudirojupa.weebly.com
- papizutexoda.weebly.com
- static.s123-cdn-static.com
- cdn-cms.f-static.net
- jumolemema.weebly.com
- vezaxudikofexi.weebly.com
- folemazilepi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report