MALICIOUS — 286fb8_3b2159c6f2384a4f98557136f1e625fa.pdf

MALICIOUS — 286fb8_3b2159c6f2384a4f98557136f1e625fa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: eda85f2300d71ea02db41ac3cbca4b6b49198b2acb4c5d4404245ece44c44e71
• SHA-1: b5b5efa678d16b9679470a4cea94c097dac7e438
• MD5: 81eb33c288b1fd3dacc1e34eb2f52345
• ssdeep: 1536:KhPMa5HXXHt5FW1saypNXGzpOWG3V8mpdd5pce2LH0FbSAvu5VKu2Nr8cp:KHVXN5cOpXGTG2OXrlvuHoNg2
• TLSH: T1D938D0F3608BED5CB692AB5779A311A92189C7C86131D761588C763CC5FC2EE3E10A81
• Submitted as: 286fb8_3b2159c6f2384a4f98557136f1e625fa.pdf
• File type: pdf · Size: 80029 bytes
• Verdict: malicious (94/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!81EB33C288B1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://a54de82d-0003-4787-801b-d7ee719c780a.filesusr.com/ugd/8d57bd_272031830c2048e0902cc5257ac30fc4.pdf?index=true - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://leonvi.ru/wix?keyword=murray+24+riding+mower+parts, https://wibugosavuzatug.weebly.com/uploads/1/3/4/3/134349607/pekibadu_jalupawul_wirazajuz_sixovujusineb.pdf, http://polikarmonolit.ru/inorganic_chemistry_best_book_for_mscl9gxm.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://leonvi.ru/wix?keyword=murray+24+riding+mower+parts
• https://wibugosavuzatug.weebly.com/uploads/1/3/4/3/134349607/pekibadu_jalupawul_wirazajuz_sixovujusineb.pdf
• http://polikarmonolit.ru/inorganic_chemistry_best_book_for_mscl9gxm.pdf
• https://zoxiniguve.weebly.com/uploads/1/3/4/5/134584112/9e54d7b2f6167e.pdf
• http://weputurogaxefi.iblogger.org/worx_8-amp_14-in_corded_electric_chainsaw.pdf
• http://azakalaza5.xyz/life_fitness_c3_bike_seatq9kt0.pdf
• https://pixamowogiru.weebly.com/uploads/1/3/4/5/134590731/bijuzana.pdf
• http://winenezufu.epizy.com/dezimimogagasola.pdf
• https://gapepaweduli.weebly.com/uploads/1/3/5/4/135400658/6381016.pdf
• https://gilamasizate.weebly.com/uploads/1/3/0/7/130775108/wikatoliroxadekuneg.pdf
• https://wegakerovosa.weebly.com/uploads/1/3/0/8/130873826/fizaxa-fakobuzizeragi-basipajipozav-rerur.pdf
• http://jumpfs.space/51022338790w80w0.pdf
• http://leoidet.xyz/computer_teacher_interview_questions_and_answersuomyj.pdf
• https://a54de82d-0003-4787-801b-d7ee719c780a.filesusr.com/ugd/8d57bd_272031830c2048e0902cc5257ac30fc4.pdf?index=true
• https://cdn.sqhk.co/popaxutu/iahdC2g/jurassic_island_2_lost_ark_survival_mod.pdf
• https://gopaxabog.weebly.com/uploads/1/3/5/3/135309926/3013083.pdf
• http://ninamivekadod.epizy.com/compositions_of_functions_worksheet.pdf
• http://sis-paypal.com/dudokonetufatunoguxixup5g92c.pdf
• https://cdn.sqhk.co/gujowaxexag/R9jfifh/best_japanese_fighter_of_world_war_2.pdf
• http://vonizevugopu.rf.gd/norton_power_eraser_free.pdf
• https://serarabasujuz.weebly.com/uploads/1/3/1/6/131606617/8469541.pdf
• https://959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com/ugd/ab0441_af3ed220b5644749a0626b64494d8490.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/

Embedded domains

• leonvi.ru
• wibugosavuzatug.weebly.com
• polikarmonolit.ru
• zoxiniguve.weebly.com
• weputurogaxefi.iblogger.org
• azakalaza5.xyz
• pixamowogiru.weebly.com
• winenezufu.epizy.com
• gapepaweduli.weebly.com
• gilamasizate.weebly.com
• wegakerovosa.weebly.com
• jumpfs.space
• leoidet.xyz
• a54de82d-0003-4787-801b-d7ee719c780a.filesusr.com
• cdn.sqhk.co
• gopaxabog.weebly.com
• ninamivekadod.epizy.com
• sis-paypal.com
• serarabasujuz.weebly.com
• 959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com
• vonizevugopu.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report