MALICIOUS — best_k_cup_coffee_maker_2019.pdf
MALICIOUS — best_k_cup_coffee_maker_2019.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f9953f05d765cc5d4e82df83f84fafe331afd07ba377a5bd895385d7b80f04ef - SHA-1:
9b3769fd8908f9f500338c2c0fa44cb08d5dced8 - MD5:
211eae6ae0cd0fea02dba31e845e2347 - ssdeep:
1536:hLtCcBJ5lwEnC3D4M3/U0OeqwpSwheAC08ZfRm6pHEvZkdnCD+:P1BJ5pnuDrPU0OeqZwhnk7HpHEBUnT - TLSH:
T10839E0F3719BDD5C7E9A2F437AE6155C6488C68C3132EF204190BB7C84B84AE7E58852 - Submitted as: best_k_cup_coffee_maker_2019.pdf
- File type: pdf · Size: 85400 bytes
- Verdict: malicious (96/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!211EAE6AE0CD
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/835f64cb-fe7b-427f-9ec8-f915cbbca288/what_is_the_difference_between_physical_and_social_landscape.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://fokemale.ru/strik?utm_term=best+k+cup+coffee+maker+2019, http://tigafik.mygamesonline.org/27482888168.pdf, https://uploads.strikinglycdn.com/files/835f64cb-fe7b-427f-9ec8-f915cbbca288/what_is_the_difference_between_physical_and_social_landscape.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://fokemale.ru/strik?utm_term=best+k+cup+coffee+maker+2019
- http://tigafik.mygamesonline.org/27482888168.pdf
- https://uploads.strikinglycdn.com/files/835f64cb-fe7b-427f-9ec8-f915cbbca288/what_is_the_difference_between_physical_and_social_landscape.pdf
- http://vodemenuja.epizy.com/fimarobisopenijug.pdf
- https://uploads.strikinglycdn.com/files/3ada336e-d5fe-41c9-be1f-b10ba6cdff7b/learn_photoshop_cs6_for_beginners.pdf
- http://nukobis.rf.gd/27612780644.pdf
- https://38aad9b5-7a72-45b8-ac81-9fe73ce82000.filesusr.com/ugd/08338c_35cc62573ff14be482f4498e6a7562f2.pdf?index=true
- https://f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com/ugd/1e533a_1af2f40147074fb98a4b9ed25d4cc8db.pdf?index=true
- http://mizifasurogik.mywebcommunity.org/acarologia_ernesto_doreste.pdf
- https://revafabeku.weebly.com/uploads/1/3/4/7/134708131/187706c.pdf
- http://pusapovewazigu.onlinewebshop.net/96866110141.pdf
- https://uploads.strikinglycdn.com/files/7350de06-435a-491d-a131-07dd8a2e0f3f/62748530591.pdf
- http://xidovofetukik.epizy.com/zelda_ocarina_of_time_death_mountain_crater_great_fairy.pdf
- https://f3dcd8e3-6656-4b47-a81e-a993d3c4f2a1.filesusr.com/ugd/aa9ef2_05feda8776294a9a957ff92892d9b40f.pdf?index=true
- http://vofefipegurixu.iblogger.org/play_store_save_apk_file.pdf
- http://nipokaxa.getenjoyment.net/83119289840.pdf
- http://tuzojexis.mypressonline.com/niwoxike.pdf
- https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_0e50abf1c5f44de086c22eb7ebe3ee34.pdf?index=true
- https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_fb9fde05fc194443becc11020602d179.pdf?index=true
- https://bitipares.weebly.com/uploads/1/3/1/3/131379103/sunokomanom.pdf
- https://20128683-61eb-4207-b985-d468b1a81fea.filesusr.com/ugd/0049ca_c0504caf99bb42fa969228d6a3652c49.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- fokemale.ru
- tigafik.mygamesonline.org
- uploads.strikinglycdn.com
- vodemenuja.epizy.com
- 38aad9b5-7a72-45b8-ac81-9fe73ce82000.filesusr.com
- f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com
- mizifasurogik.mywebcommunity.org
- revafabeku.weebly.com
- pusapovewazigu.onlinewebshop.net
- xidovofetukik.epizy.com
- f3dcd8e3-6656-4b47-a81e-a993d3c4f2a1.filesusr.com
- vofefipegurixu.iblogger.org
- nipokaxa.getenjoyment.net
- tuzojexis.mypressonline.com
- 6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com
- 8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com
- bitipares.weebly.com
- 20128683-61eb-4207-b985-d468b1a81fea.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
- nukobis.rf.gd
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report