MALICIOUS — 60883428346.pdf
MALICIOUS — 60883428346.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f72a71d6c3f29360e3da892ae78b512ab175681579152374209de7f5165665fc - SHA-1:
836db23b22d0a3df154f5a7ec72b5cedf64eea7e - MD5:
2ccb36e80b893888c726e479fcd36f35 - ssdeep:
1536:U+5HftT+N2g14tHTFZfox0CWJc+lwjl0XXk/Bmlr3+8xWapOtQHWMtWvvPfzjFLb:dHFKN2XH/nCWCSjHCeu8+tQ7W3HzjU2 - TLSH:
T1B838D0F32147CD8C7B1B5B436EFB1194A09BD3886265EB514188B61CB6BC5BE7F00A10 - Submitted as: 60883428346.pdf
- File type: pdf · Size: 77767 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://twfindia.in/userfiles/files/somosebulubokijedujisi.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: http://altadirezione-consulting.it/userfiles/files/vatugoxa.pdf, https://markmont.eu/editor_uploads/system/files/tivalumoronipo.pdf, https://nitdgp.ac.in/uploads/userfiles/files/tisufewafimarin.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=download+neighbours+from+hell+full+version+for+android
- http://altadirezione-consulting.it/userfiles/files/vatugoxa.pdf
- https://markmont.eu/editor_uploads/system/files/tivalumoronipo.pdf
- https://nitdgp.ac.in/uploads/userfiles/files/tisufewafimarin.pdf
- http://ckm-machinery.com/userfiles/files/fatukuvuzarukiduratabu.pdf
- https://www.pharmaright.ca/wp-content/plugins/super-forms/uploads/php/files/np14gcc2sm89u759ubfpgbi9ah/sixuzikikoka.pdf
- http://ukwoodrecycling.com/userfiles/files/vopekedituvolekika.pdf
- https://strongpointmarketing.net/userfiles/file/53027751534.pdf
- https://yifff.se/userfiles/file/butujopujebikinepexolomo.pdf
- http://le383.com/uploads/files/xotoranajitobadu.pdf
- http://twfindia.in/userfiles/files/somosebulubokijedujisi.pdf
- http://modellszerviz.hu/userfiles/file/kumosudajunulafafe.pdf
- https://landtop.com/filespath/files/20210908190136.pdf
- http://administratieindex.nl/images/uploads/14953437327.pdf
- http://cityfate.com/files/files/loredilife.pdf
- http://hftyby.com/upload_fck/file/2021-9-19/20210919032022965386.pdf
- https://glamweddingdesign.com/userfiles/file/nomupizu.pdf
- http://hdg-gmuend.de/userfiles/files/teruberiligew.pdf
- http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/dfdc65d62ee234d32c1b59fc618320c6/sanenilugogew.pdf
- http://modelkyujin.com/wp-content/plugins/formcraft/file-upload/server/content/files/16137ba0cee1d8---25797850649.pdf
- https://franchisefarm.franchiseharbor.com/files/files/73412215755.pdf
- http://alemotta.com/resources/original/file/kivafilidipukimalufaxab.pdf
- http://perfectionistpaintingnj.com/ckfinder/userfiles/files/poledejelawunekegun.pdf
- http://chothuexehochiminh.com/userfiles/file/37543793844.pdf
- https://glamweddingdesign.com/userfiles/file/42054153245.pdf
Embedded domains
- feedproxy.google.com
- altadirezione-consulting.it
- markmont.eu
- nitdgp.ac.in
- ckm-machinery.com
- www.pharmaright.ca
- ukwoodrecycling.com
- strongpointmarketing.net
- yifff.se
- le383.com
- twfindia.in
- landtop.com
- administratieindex.nl
- cityfate.com
- hftyby.com
- glamweddingdesign.com
- hdg-gmuend.de
- www.myhhsi.com
- modelkyujin.com
- franchisefarm.franchiseharbor.com
- alemotta.com
- perfectionistpaintingnj.com
- chothuexehochiminh.com
- topclassgreenery.nl
- www.w3.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report