General

  • Target

    4447c8ea6642b37538822292dc46192a7039dc54ab0d889172ab25dd15353f11

  • Size

    2.9MB

  • MD5

    d4f5b98d072f061e4ae41a8fb7c9bf6d

  • SHA1

    4443abaf018dffb34746b649e3b289c97082e778

  • SHA256

    4447c8ea6642b37538822292dc46192a7039dc54ab0d889172ab25dd15353f11

  • SHA512

    05df53c39122be884130d725f1fee26fc54a5ad3c7b33026a93ff298148eb509460cca32776aa4704f8c8e970970e9f633077f2a3ee1c4c6918282c0aa9b91f1

  • SSDEEP

    49152:I66fsKpKV8fJTaNeX+2faOrNETjuEH51dYEX+WYvdfzgb1gdu0fl5X/oMlf:IT8ifJTB+8rN4juEH51dvOWGt5du0fQI

Score
10/10

Malware Config

Signatures

  • Merlin family
  • Merlin payload 1 IoCs
  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

Files

  • 4447c8ea6642b37538822292dc46192a7039dc54ab0d889172ab25dd15353f11
    .pdf
    • https://www.torproject.org/

    • https://www.wifimap.io/

    • https://tails.boum.org/

    • https://www.ramnode.com/

    • https://nicevps.net/

    • https://www.cinfu.com/

    • https://pivps.com/

    • https://securedragon.net/

    • https://bitlaunch.io/

    • Show all