MALICIOUS — 16135cbbf329ea---72027009859.pdf

MALICIOUS — 16135cbbf329ea---72027009859.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 04e6855dcbda15f9e02c9fbe8f80188510a4554848c8714d481de18bd5510e17
• SHA-1: ed264f63267b338c5dcdede777fd2c8c63022d16
• MD5: 897a415f21d62a156a28668fc65feca4
• ssdeep: 1536:0BqwbU44nmshbyRsGKh/ZoHlyzZ2WPV1ky1xG9jM1WspO2vOg:wqwQzmsZyRsXhoFINVay1EGc21
• TLSH: T1A939D0F330ABDD4C769ADB4768F6146C6086E7881231EE5000C8BB5CD57CA7DBE28951
• Submitted as: 16135cbbf329ea---72027009859.pdf
• File type: pdf · Size: 87646 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://maxim-catering.de/wp-content/plugins/super-forms/uploads/php/files/cqa60711e67uotcvc04r7m7ev2/rageriri.pdf, https://bawwabatrizq.com/userfiles/file/16842536944.pdf, https://inprovitpuertorico.com/ckfinder/userfiles/files/28311780199.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=peripheral+arterial+disease+guidelines+2016+pdf
• https://maxim-catering.de/wp-content/plugins/super-forms/uploads/php/files/cqa60711e67uotcvc04r7m7ev2/rageriri.pdf
• https://bawwabatrizq.com/userfiles/file/16842536944.pdf
• https://inprovitpuertorico.com/ckfinder/userfiles/files/28311780199.pdf
• https://terminarz.online/kosmetyczka/krakow/files/43066476685.pdf
• https://ubitanduk.com/contents/files/tilubejimavinodutiwesugor.pdf
• https://www.sixteengrams.com/wp-content/plugins/super-forms/uploads/php/files/bvl45uduqia83m17dllaqar8o4/ponesodokuzosilesanu.pdf
• http://ping-property.com/user_img/files/55863403310.pdf
• http://fabriziocar.it/userfiles/files/94447928258.pdf
• http://kirilmazbardak.com/userfiles/file/94530891510.pdf
• http://shop-cartuning.pl/userfiles/file/90073596441.pdf
• https://lescourailleurs.com/upload/editor/file/pibaxudazununaxozep.pdf
• http://thefencedocumentary.ca/adminfiles/file/ludek.pdf
• https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a971018ed32---42002036659.pdf
• http://yildizteknikelektrik.net/resimler/files/54656984677.pdf
• http://aquamedia.cn/ckfinder/userfiles/files/7118601067.pdf
• https://lorenzonimmigrationlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab6c5f00dff---70536444869.pdf
• https://gencshoworganizasyon.com/upload/ckfinder/files/93620518811.pdf
• http://gwardiajuvenia.pl/zdjecia/fck/file/85030966388.pdf
• http://www.autoservis-hubatka.cz/admin/upload/ww/file/78802321715.pdf
• http://flex-link.cn/uploadfiles/files/19540990966.pdf
• http://bukhatirhomes.com/userfiles/file/65073163882.pdf
• http://interno-kazan.ru/upload/files/58653915554.pdf
• http://wolfroccatiassociati.it/userfiles/files/volodegibojatitijifavedo.pdf
• http://www.realisthotel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099c9bbe6837---38378445192.pdf

Embedded domains

• feedproxy.google.com
• maxim-catering.de
• bawwabatrizq.com
• inprovitpuertorico.com
• terminarz.online
• ubitanduk.com
• www.sixteengrams.com
• ping-property.com
• fabriziocar.it
• kirilmazbardak.com
• shop-cartuning.pl
• lescourailleurs.com
• thefencedocumentary.ca
• drivingschoolofnorthtexas.com
• yildizteknikelektrik.net
• aquamedia.cn
• lorenzonimmigrationlaw.com
• gencshoworganizasyon.com
• gwardiajuvenia.pl
• flex-link.cn
• bukhatirhomes.com
• interno-kazan.ru
• wolfroccatiassociati.it
• www.realisthotel.com
• www.w3.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report