MALICIOUS — 3427958.pdf

MALICIOUS — 3427958.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: e50e751fe2f936d2ef9e8dc866cc2b6bcdd8b9780b355618dbae2b329f9dfa53
• SHA-1: 75965b1dbd40320cad31603f1772b1ef1df5e57c
• MD5: 5e5510060298fd02290f3275941a4d3f
• ssdeep: 1536:nnbcrAXTYfv2dXZA++cvgDCte1+PS/4uZHcy5tkdBgqb:nbPDdXeU4uw1+PSQ/AtUX
• TLSH: T14637E1F3600BDE4C695A671369F226486449CB4C62726BB054C8FA7CC4BC7FD6C25602
• Submitted as: 3427958.pdf
• File type: pdf · Size: 73129 bytes
• Verdict: malicious (94/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://merotulup.weebly.com/uploads/1/3/4/0/134000288/edc6004fad.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://trafffe.ru/wb?keyword=borderlands%203%20dlc%201%20raid%20boss, https://merotulup.weebly.com/uploads/1/3/4/0/134000288/edc6004fad.pdf, https://uploads.strikinglycdn.com/files/43381702-1aad-4013-9cb3-ddab8887e36b/kobalt_kt1015_replacement_parts.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffe.ru/wb?keyword=borderlands%203%20dlc%201%20raid%20boss
• https://merotulup.weebly.com/uploads/1/3/4/0/134000288/edc6004fad.pdf
• https://s3.amazonaws.com/bewibiwat/79453324458.pdf
• https://uploads.strikinglycdn.com/files/43381702-1aad-4013-9cb3-ddab8887e36b/kobalt_kt1015_replacement_parts.pdf
• https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/6069273.pdf
• https://uploads.strikinglycdn.com/files/742bd479-da96-4998-880e-5605f5803bb0/fuliwepijeludiweg.pdf
• https://uploads.strikinglycdn.com/files/c81504bd-fba0-4cfc-8da4-9959426fa018/27501625360.pdf
• https://xikewewojan.weebly.com/uploads/1/3/4/0/134095915/242d28a9bbf9274.pdf
• https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/rosavogulidopoli.pdf
• https://s3.amazonaws.com/mazugezijap/jerunipepipimedobozobozi.pdf
• https://zosopomejunij.weebly.com/uploads/1/3/4/0/134040517/vevigeme-fodorodefogowot.pdf
• https://kafememum.weebly.com/uploads/1/3/4/6/134616831/9200828.pdf
• https://uploads.strikinglycdn.com/files/a1e51d91-ab8d-4a7b-8ed2-cab3659dee98/persona_5_devils_curve.pdf
• https://s3.amazonaws.com/pasawe/72788531364.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffe.ru
• merotulup.weebly.com
• s3.amazonaws.com
• uploads.strikinglycdn.com
• bedizegoresupa.weebly.com
• xikewewojan.weebly.com
• jamuseramomuf.weebly.com
• zosopomejunij.weebly.com
• kafememum.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report