MALICIOUS — 27537725801.pdf

MALICIOUS — 27537725801.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f6535d96964a0f03778af19cae93f361caf1d7cbe5f700deff27fdb877b82b55
• SHA-1: 91e6638a14f6ad2d5fac69e196b8743377e1441a
• MD5: 32945c6e9da8aa766fc08df10410e286
• ssdeep: 1536:h5BdZeERNjwt2O8s3NBpcsKwoiUSI+aNbiEQy08t6fsNAgiTTzV5gJAQgRXkmFWz:LHZjji2O3NxKAUd+adBdt6fsr0oWQgRQ
• TLSH: T1A23AE0B32097CDCC3A874B0329EA5A6864C7C68830739F685584BB6CD5BCABD7F10901
• Submitted as: 27537725801.pdf
• File type: pdf · Size: 95971 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075e0b22189c---95537017243.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/160cf093c5c919---91207667873.pdf, https://lightsourceindiana.com/wp-content/plugins/super-forms/uploads/php/files/447838463724803450feeb04769feb35/95110590687.pdf, https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075e0b22189c---95537017243.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=gts+growth+comics
• http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/160cf093c5c919---91207667873.pdf
• https://lightsourceindiana.com/wp-content/plugins/super-forms/uploads/php/files/447838463724803450feeb04769feb35/95110590687.pdf
• https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075e0b22189c---95537017243.pdf
• https://transport-vehicules.fr/userfiles/file/26829418196.pdf
• http://dabaizhongxue.com/upload_fck/file/2021-6-9/20210609074229121997.pdf
• http://airconbank.com/upload/fckeditor/file/wanatukovofo.pdf
• http://teifsepahan.com/files/file/18539440365.pdf
• https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/de69f34a7060618d6255ca8deb21bbbe/mesasime.pdf
• http://market-oborudovanie.ru/upload/file/bomaxerovorabudexo.pdf
• http://stillwaterponies83.com/clients/74660/File/97029747839.pdf
• https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/795f53da536a81d63d263932466b7a41/vapojugap.pdf
• https://www.advids.io/wp-content/plugins/formcraft/file-upload/server/content/files/160c5c4f268b42---mizomomuzamubogotopaw.pdf
• https://vetranhtuongmamnon.vn/wp-content/plugins/super-forms/uploads/php/files/a4ucmjp6rj69gj2asfo1qcjgna/sijewud.pdf
• https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f1e18d9b73---berinesuvubaxiwemesuwim.pdf
• http://perles-del-beya.com/userfiles/file/rulixurupebawonunowolafu.pdf
• https://adepotcustom.com/UploadFiles/file/20210429192435183.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• dabien.co.kr
• lightsourceindiana.com
• www.grecosalesinternational.com
• transport-vehicules.fr
• dabaizhongxue.com
• airconbank.com
• teifsepahan.com
• n95america.com
• market-oborudovanie.ru
• stillwaterponies83.com
• 40parables.com
• www.advids.io
• perles-del-beya.com
• adepotcustom.com
• www.w3.org
• purl.org
• ns.adobe.com
• vetranhtuongmamnon.vn

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report