MALICIOUS — 7_pulgadas_en_cm_es.pdf
MALICIOUS — 7_pulgadas_en_cm_es.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e900d0eb21c22ce299a69f17935d90c2c7c9b5f8eb76292624e7a9edf3c8995e - SHA-1:
d44ecc30419d8eaf01767e61eace2f16e724a2e5 - MD5:
58eb60e1d51dd83e5b192edda03d049e - ssdeep:
1536:KurB8flvoug0WGKcUmj6TvxbotW17wvNxQc7PnHsfi7DcIisQCl+BOKfjI:brSflLWGzUmj4v2tiEvNxdcIisQt4b - TLSH:
T1C338C0F31183DE5CB68F975369FB259DB08AD68861335B100488B66CC47C76E7F60A11 - Submitted as: 7_pulgadas_en_cm_es.pdf
- File type: pdf · Size: 82841 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!58EB60E1D51D
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com/ugd/e66789_d52e397bd213471da3b690c7fc7dedaf.pdf?index=true - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://soxebez.ru/strik?utm_term=7+pulgadas+en+cm+es, http://zubiluwetij.myartsonline.com/does_dunkin_doughnuts_have_decaf_coffee.pdf, https://891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com/ugd/e66789_d52e397bd213471da3b690c7fc7dedaf.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://soxebez.ru/strik?utm_term=7+pulgadas+en+cm+es
- http://zubiluwetij.myartsonline.com/does_dunkin_doughnuts_have_decaf_coffee.pdf
- https://891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com/ugd/e66789_d52e397bd213471da3b690c7fc7dedaf.pdf?index=true
- https://s3.amazonaws.com/loranoduzuja/50252454549.pdf
- http://rogevunesopu.medianewsonline.com/29971479576.pdf
- https://vuzigalami.weebly.com/uploads/1/3/5/9/135960382/011ea34fe176.pdf
- https://nakafafokebupop.weebly.com/uploads/1/3/1/4/131437029/92e9c1.pdf
- https://ziluxofizavamo.weebly.com/uploads/1/3/6/0/136009732/siwejutozi.pdf
- https://01dc7cc6-b8ed-446e-8cc8-1ad78882ed38.filesusr.com/ugd/e23fbb_ecc61ea4a99a46fb892b8f24dcfa60cd.pdf?index=true
- https://jewelilug.weebly.com/uploads/1/3/4/3/134331877/pinog_femukel.pdf
- https://s3.amazonaws.com/fosalizuzu/45807940111.pdf
- https://zefotuji.weebly.com/uploads/1/3/0/7/130738972/448867.pdf
- https://rotarivinevi.weebly.com/uploads/1/3/4/5/134599250/546930.pdf
- https://joxunirefebemi.weebly.com/uploads/1/3/4/3/134319414/sibifedujarado.pdf
- https://s3.amazonaws.com/lazolu/poly_coated_kraft_paper_sheets.pdf
- https://s3.amazonaws.com/mojivikapeti/vodefir.pdf
- https://vogovolakufa.weebly.com/uploads/1/3/4/8/134874318/kilurejamo_fiderulukixexos_xovowa.pdf
- https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_3cc2c83677d14820a0a762170d31da58.pdf?index=true
- https://s3.amazonaws.com/dobesogum/64506469931.pdf
- http://kubosikavudux.mygamesonline.org/tutorial_autocad_electrical_2016_espaol.pdf
- https://lusogovo.weebly.com/uploads/1/3/4/3/134358567/jifomajusov-xopefoxepine.pdf
- https://gumevuwogixuxuj.weebly.com/uploads/1/3/5/3/135317748/kolekodebez-gokuxarabiguni-wodibirifegepe-wodob.pdf
- https://891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com/ugd/e66789_ab3fc887e2ad4978b20b3a5e2e23379d.pdf?index=true
- https://lewozokor.weebly.com/uploads/1/3/5/4/135400983/febemibadoxipore.pdf
- https://jimivisimobud.weebly.com/uploads/1/3/4/9/134901817/livulel_luralojo_kinapaje.pdf
Embedded domains
- soxebez.ru
- zubiluwetij.myartsonline.com
- 891dfe3a-8969-4df2-b253-5ccc4ebbb7a0.filesusr.com
- s3.amazonaws.com
- rogevunesopu.medianewsonline.com
- vuzigalami.weebly.com
- nakafafokebupop.weebly.com
- ziluxofizavamo.weebly.com
- 01dc7cc6-b8ed-446e-8cc8-1ad78882ed38.filesusr.com
- jewelilug.weebly.com
- zefotuji.weebly.com
- rotarivinevi.weebly.com
- joxunirefebemi.weebly.com
- vogovolakufa.weebly.com
- 2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com
- kubosikavudux.mygamesonline.org
- lusogovo.weebly.com
- gumevuwogixuxuj.weebly.com
- lewozokor.weebly.com
- jimivisimobud.weebly.com
- tuxedibuzi.weebly.com
- revowerixes.weebly.com
- motutipe.weebly.com
- www.w3.org
- purl.org
File paths
- J:\z
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report