MALICIOUS — 2139971.pdf

MALICIOUS — 2139971.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f4e3c5c289e2a56e4062f6f0e9a69dda610f711a23785cdfdb009847a041af8e
• SHA-1: c7fe73796c58c8cd30fb4a806fbcbbb4cbab3b74
• MD5: 1aac70ed64c74ec031ac4ee912b0a0b2
• ssdeep: 1536:tYl+kEPZPrZZavMKsx5Or715o4AQ70RKoANUWyyrfsTZaA0VY3NFlTVeiR8Z/B6s:e4kEPZlZkMZwo43KefKjv5DaZ/F
• TLSH: T11138CFF31257DE9C7B8B4B47ACE605742885D3993122D7A0448C7BBCC5B826E7FA0A50
• Submitted as: 2139971.pdf
• File type: pdf · Size: 80264 bytes
• Verdict: malicious (96/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!1AAC70ED64C7
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4473403/normal_60026fa3aed25.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://yafferge.ru/wb?keyword=cambridge%20ielts%209%20listening%20test%201%20youtube, http://hardcreditcheck.info/57173872271bg088.pdf, http://graatorama.fun/is_there_any_free_games_on_ps4x228d.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://yafferge.ru/wb?keyword=cambridge%20ielts%209%20listening%20test%201%20youtube
• http://hardcreditcheck.info/57173872271bg088.pdf
• https://s3.amazonaws.com/bisiku/88795640433.pdf
• http://graatorama.fun/is_there_any_free_games_on_ps4x228d.pdf
• https://cdn-cms.f-static.net/uploads/4404966/normal_5fe77614dfe81.pdf
• https://s3.amazonaws.com/vexosafugunu/ar-_15_assembly_manual.pdf
• http://alteramaks.world/beating_the_street_bookaghuc.pdf
• https://sirowatogiwu.weebly.com/uploads/1/3/2/8/132814809/899b72fa7.pdf
• https://gepemizuwawufak.weebly.com/uploads/1/3/4/3/134335313/pivemuf_totozuluvabi_ginekap_rovak.pdf
• https://static.s123-cdn-static.com/uploads/4473403/normal_60026fa3aed25.pdf
• https://static.s123-cdn-static.com/uploads/4383471/normal_5feb110f53a3b.pdf
• https://static.s123-cdn-static.com/uploads/4457590/normal_5fc94acb0f671.pdf
• https://s3.amazonaws.com/sorogamat/chemical_bonding_notes_class_11.pdf
• https://s3.amazonaws.com/zufojadibi/19747025743.pdf
• https://nobenala.weebly.com/uploads/1/3/4/3/134348336/4122514.pdf
• https://s3.amazonaws.com/rurosaveruk/liluzaserabuwuwanokasawer.pdf
• https://fazugiwe.weebly.com/uploads/1/3/4/0/134012697/99d0e2acf.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• yafferge.ru
• hardcreditcheck.info
• s3.amazonaws.com
• graatorama.fun
• cdn-cms.f-static.net
• alteramaks.world
• sirowatogiwu.weebly.com
• gepemizuwawufak.weebly.com
• static.s123-cdn-static.com
• nobenala.weebly.com
• fazugiwe.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report