MALICIOUS — wabam.pdf
MALICIOUS — wabam.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ef1b742fbd555b68a677e7f3b6d21f6d1f8d341bbc9e9e10014704db25bd1369 - SHA-1:
3c052f677a55936a1d2d7894af7057a4d448e9d7 - MD5:
fc33ec3fb2329e1f13384b9b42cb91bc - ssdeep:
1536:BTAc8cheGFxvF+nBZIQpP/P+jGOClPeD3V6rONhvWepOyWW/GDCrOOcBdtlU:JndVNQpP/P+jGOmPU3V6qNhsyg2/c8 - TLSH:
T17A39BEF360A7ED5CB3975B435AA1019D7599E7486273A7904488F63CC9BCAFCAF00842 - Submitted as: wabam.pdf
- File type: pdf · Size: 91707 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://ambulatorioveterinarioilghirlandaio.it/userfiles/files/92038606505.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://catamma.ru/uplcv?utm_term=solucionario+del+libro+de+hibbeler+dinamica+12+edicion+pdf, http://razaviota.ir/basefile/razaviotair/files/77026009318.pdf, http://amctop.com/board_data/editor_img/file/202107010251.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://catamma.ru/uplcv?utm_term=solucionario+del+libro+de+hibbeler+dinamica+12+edicion+pdf
- http://razaviota.ir/basefile/razaviotair/files/77026009318.pdf
- http://amctop.com/board_data/editor_img/file/202107010251.pdf
- https://norservis.com/files/files/pujodedisigape.pdf
- http://ambulatorioveterinarioilghirlandaio.it/userfiles/files/92038606505.pdf
- https://nic-irq.com/userfiles/files/17501730288.pdf
- https://ipcare.nl/wp-content/plugins/super-forms/uploads/php/files/vm6veifnm8oo74udqtnpo6ap5u/wekaxadezipu.pdf
- http://optykglowacki.pl/obrazki/files/38156505624.pdf
- https://www.lenoir-elec.com/wp-content/plugins/super-forms/uploads/php/files/0tpqnnfg45nd9co55ggunvub2u/bakebofaxikuwenuv.pdf
- https://bamfieldrental.com/userfiles/file/rasotujuredow.pdf
- http://beergolfers.com/blog/images/file/40060877599.pdf
- http://nhuaduongnhapkhauaz.com/upload/files/87295943524.pdf
- http://memsports.com.br/admin/libs/ckeditor/ckfinder/files/68226876973.pdf
- http://technology-mp.it/userfiles/files/24587683845.pdf
- http://climtech.com/files/files/54433140362.pdf
- https://www.treehousecare.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607e9f6e35d37---83929721749.pdf
- http://scissortailfarms.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a39dfc9cacf---55423864186.pdf
- https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/2ba42e7ebd4fd0d7b74e2a9d0b20c2b0/laxaladalukilone.pdf
- http://www.stallionreadymix.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607d6e5073aa1---musaluku.pdf
- https://a5productions.com/home/a5pro/public_html/ckfinder/userfiles/files/gatofegojoz.pdf
- http://ytbozhuo.com/upload/file/051220239568.pdf
- http://studiotecniconuti.it/userfiles/files/27089907726.pdf
- http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084390876177---sizewigutuzexatuverokoxe.pdf
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/6603af99e4fc4510416e18559ea8ecb8/89831573876.pdf
- https://usssecuritate.ro/userfiles/file/49617289828.pdf
Embedded domains
- catamma.ru
- razaviota.ir
- amctop.com
- norservis.com
- ambulatorioveterinarioilghirlandaio.it
- nic-irq.com
- ipcare.nl
- optykglowacki.pl
- www.lenoir-elec.com
- bamfieldrental.com
- beergolfers.com
- nhuaduongnhapkhauaz.com
- memsports.com.br
- technology-mp.it
- climtech.com
- www.treehousecare.org
- scissortailfarms.com
- www.18fire.com
- www.stallionreadymix.co.za
- a5productions.com
- ytbozhuo.com
- studiotecniconuti.it
- gingerwooddesign.com
- gift-edu.ru
- www.w3.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report