MALICIOUS — e8e04fd759cf039561a9d5b5c89fbdd7e9fcb4913cd8e531861a36bdf7435fa3
MALICIOUS — e8e04fd759cf039561a9d5b5c89fbdd7e9fcb4913cd8e531861a36bdf7435fa3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e8e04fd759cf039561a9d5b5c89fbdd7e9fcb4913cd8e531861a36bdf7435fa3 - SHA-1:
37fc1e6d477bff218fcffa39c6c2dd20011bdd91 - MD5:
162a6b1164e6465aa8c26afea51928db - ssdeep:
1536:m1j7g2Md7aJdXumFQuJ9WnQF7A5ZsviRWMdtYFRCIVAhWQpOCoW967XBH18Em:2EQdXNquHFA5ZsgWMdtYbJCYCN6791E - TLSH:
T1ED38D0F350ABDD9CBA97AB437DFB115990C9D7840062EA9040CCBA6CC1BC9BDEE14941 - Submitted as: e8e04fd759cf039561a9d5b5c89fbdd7e9fcb4913cd8e531861a36bdf7435fa3
- File type: pdf · Size: 84279 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://xn--atpta-nfb.lv/images/userfiles/files/47310637561.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://xn--atpta-nfb.lv/images/userfiles/files/47310637561.pdf, http://ttlengenharia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/161324956565a6---mirifofuzeno.pdf, http://falconfam.com/ckfinder/userfiles/files/58630265967.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=bully+game+play+store
- https://xn--atpta-nfb.lv/images/userfiles/files/47310637561.pdf
- http://ttlengenharia.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/161324956565a6---mirifofuzeno.pdf
- http://falconfam.com/ckfinder/userfiles/files/58630265967.pdf
- http://canphantich.net/Images_upload/files/legakemofelakamege.pdf
- http://sztarmedia.hu/_user/file/xomepep.pdf
- https://xtrafitcoaching.com/www/images/files/diwidula.pdf
- http://dryoucosmeceutical.com/userfiles/files/81653240087.pdf
- http://mh-gartengestaltung.de/userfiles/file/77468889847.pdf
- http://filtrydokoparek.pl/img/all/43405409537.pdf
- http://keyflounge.nl/userfiles/file/31629626748.pdf
- https://mosconi.net/userfiles/file/manifivi.pdf
- http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/161455b33c5d82---tunolotoruwere.pdf
- https://www.helpagesl.org/wp-content/plugins/formcraft/file-upload/server/content/files/16141b8a58e7dc---51602559808.pdf
- https://ariaparvaz.com/basefile/ariaparvazcom/files/87330522106.pdf
- https://condominiovillage.com/userfiles/file/21999639228.pdf
- http://findacommodity.com/upload/file/95953463921.pdf
- http://mamolenasnc.it/userfiles/files/padimowodifovesetakax.pdf
- http://ukrfirework.com/images/file/38508949334.pdf
- https://handinhand-daycare.com/ckfinder/userfiles/files/subigan.pdf
- http://chithanhplastics.com/uploads/userfiles/file/18206262529.pdf
- https://angelsolutions.ro/ckeditor/ckfinder/userfiles/files/27053932142.pdf
- https://lawrenceyezersky.com/userfiles/file/bowadezuxibokit.pdf
- http://sushigonewildtogo.com/uploads/files/40831860876.pdf
- http://gachmenminhchien.com/media/ftp/file/bozagiz.pdf
Embedded domains
- 9f.ga
- feedproxy.google.com
- ttlengenharia.com.br
- falconfam.com
- canphantich.net
- xtrafitcoaching.com
- dryoucosmeceutical.com
- mh-gartengestaltung.de
- filtrydokoparek.pl
- keyflounge.nl
- mosconi.net
- www.hptindia.com
- www.helpagesl.org
- ariaparvaz.com
- condominiovillage.com
- findacommodity.com
- mamolenasnc.it
- ukrfirework.com
- handinhand-daycare.com
- chithanhplastics.com
- lawrenceyezersky.com
- sushigonewildtogo.com
- gachmenminhchien.com
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report