MALICIOUS — puvisek-fikix-mojataj.pdf

MALICIOUS — puvisek-fikix-mojataj.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: ea4d608fffbe6cfb0d616682cb39fd8790871ec170a0f3742bd303c3a6e7d78f
SHA-1: 7d4e7362da6bef09c98050ae44515ef16c04cd0d
MD5: 4c1590722cfb1bc89702b0fc647f7b6e
ssdeep: 1536:aN3x7Cls6rGd4jMLXhlphXBLwgi4AsKtw6oJElSTzy6:M94rGdQopxKgiaLNTj
TLSH: T18E37D0F72197DD1CBFDE4F53BAAA255DF114D28C60338A5045C89A2CC8BC6BD6E50A02
Submitted as: puvisek-fikix-mojataj.pdf
File type: pdf · Size: 72536 bytes
Verdict: malicious (96/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!4C1590722CFB
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4413473/normal_5fce76ffc3b5a.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://druttle.ru/wb?keyword=how%20to%20replace%20door%20latch%20on%20whirlpool%20duet%20washer, https://static.s123-cdn-static.com/uploads/4413473/normal_5fce76ffc3b5a.pdf, http://tryporte.xyz/precalculus_right_triangle_trigonometry_worksheet59zwo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://druttle.ru/wb?keyword=how%20to%20replace%20door%20latch%20on%20whirlpool%20duet%20washer
https://static.s123-cdn-static.com/uploads/4413473/normal_5fce76ffc3b5a.pdf
http://tryporte.xyz/precalculus_right_triangle_trigonometry_worksheet59zwo.pdf
http://bu-markett.com/piniviwiriwulisonimolaliearyk.pdf
https://gunajogozezulom.weebly.com/uploads/1/3/5/3/135385825/f763c1284.pdf
https://cdn-cms.f-static.net/uploads/4380226/normal_6028f8f0a590a.pdf
http://medtechnika1.ru/escuela_estructuralista_psicologiapx4u8.pdf
http://taher-tcac.com/final_fantasy_15_strategy_guidequ02e.pdf
https://cdn.sqhk.co/runudori/haNcjga/3417095441.pdf
http://afracheat5.xyz/526243464114iqjs.pdf
http://wgathering.org/26145200046nid0v.pdf
https://cdn-cms.f-static.net/uploads/4420924/normal_60280c0547a9f.pdf
http://anbieterbewertung-autoscoutch.com/89922550920qyf3r.pdf
http://repair-foto.ru/42282067177hmden.pdf
http://ses-sanobrabotka.ru/dapogolujoxaeixme.pdf
http://feyakast.online/30246093737sa820.pdf
https://cdn.sqhk.co/bowewulaxam/ghjcjib/superhero_hook_stickman_swing_rope_hero_2.pdf
https://cdn-cms.f-static.net/uploads/4384832/normal_602efb7f7bea9.pdf
http://boxberry-24.cc/60140042616kys00.pdf
https://cdn.sqhk.co/zumufapofow/xjbhcWF/kizuwex.pdf
http://lnstagramcopyrightservices.org/98249685222p6uzf.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

druttle.ru
static.s123-cdn-static.com
tryporte.xyz
bu-markett.com
gunajogozezulom.weebly.com
cdn-cms.f-static.net
medtechnika1.ru
taher-tcac.com
cdn.sqhk.co
afracheat5.xyz
wgathering.org
anbieterbewertung-autoscoutch.com
repair-foto.ru
ses-sanobrabotka.ru
feyakast.online
boxberry-24.cc
lnstagramcopyrightservices.org
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report