MALICIOUS — 66877984826.pdf
MALICIOUS — 66877984826.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f877987514d8812a5a733a28823b679b0461d4ef65b95e2a8b779690668761fa - SHA-1:
43499aea2a5325b78e86da19e947be144eaaeab9 - MD5:
984552ccb5a377f7b30d7eec4baeeed7 - ssdeep:
1536:Ar8lDlc5N3t2n61nukUFXMH8XXze9QF4anUWXjehRdNWUpO7MmH:llEN3tPRUSH8nzUzanHehRdw7d - TLSH:
T14437BFF320A7DDAC7B4B9F43ADEB11989089D3892152EFA0814CB66C857C97DBF04910 - Submitted as: 66877984826.pdf
- File type: pdf · Size: 70627 bytes
- Verdict: malicious (94/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/16144fb4a640e5---82764316992.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: http://ahdjcm.com/upload/files/86878370827.pdf, http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/16144fb4a640e5---82764316992.pdf, https://phase1acoustics.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614389c98735c---bositivuzeladaligutaze.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=quotes+about+playing+games+in+a+relationship
- http://ahdjcm.com/upload/files/86878370827.pdf
- http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/16144fb4a640e5---82764316992.pdf
- https://phase1acoustics.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614389c98735c---bositivuzeladaligutaze.pdf
- http://villalapinetafavignana.it/userfiles/files/sukexot.pdf
- https://makenie.com/upload/files/saxelusa.pdf
- https://www.denisonlandscaping.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614146ecbcd4c---8708859383.pdf
- http://dreesmann-foto.de/userfiles/file/93678167651.pdf
- http://avvocatogiuliani.it/userfiles/files/30206494169.pdf
- http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/161465afc3659e---nolapuvakobavimo.pdf
- https://hearing-outlet.com/uploads/files/202109030950435028.pdf
- http://tysons-cafe.com/uploads/files/29868608978.pdf
- https://chaletsuenodesol.de/files/9147446400.pdf
- http://k3projekt.pl/uploads/userfiles/files/99639247482.pdf
- https://takarasushimn.com/userfiles/files/61477164581.pdf
- http://sichera.eu/userfiles/files/93129445856.pdf
- https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/161544fa42db74---64782555453.pdf
- http://angelofthewinds.net/ckfinder/userfiles/files/volufexuzovonagisumeruv.pdf
- http://szyqjsj.com/UploadFile/file/20210918095427597.pdf
- http://auto-rad.pl/userfiles/file/kusemuretugilokokisisum.pdf
- http://imcborivali.org/userfiles/file/lekexu.pdf
- http://sriraghavendratemple.com/ckfinder/userfiles/files/74365898605.pdf
- https://aodaixuan.vn/app/webroot/upload/image/files/zikutavasolomidusad.pdf
- http://bharatdarshan.net/rgroup/ckfinder/userfiles/files/92917951674.pdf
- http://tacchigroup.com/public/thread/risorse/file/87594100584.pdf
Embedded domains
- feedproxy.google.com
- ahdjcm.com
- kaufdeinauto.de
- phase1acoustics.com
- villalapinetafavignana.it
- makenie.com
- www.denisonlandscaping.com
- dreesmann-foto.de
- avvocatogiuliani.it
- gingerwooddesign.com
- hearing-outlet.com
- tysons-cafe.com
- chaletsuenodesol.de
- k3projekt.pl
- takarasushimn.com
- sichera.eu
- angelofthewinds.net
- szyqjsj.com
- auto-rad.pl
- imcborivali.org
- sriraghavendratemple.com
- bharatdarshan.net
- tacchigroup.com
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report