MALICIOUS — 90200862749.pdf

MALICIOUS — 90200862749.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 099a98f2a292a92e441208c3e13afe08b05bffcc2a2773e7f95367d21baf69e6
• SHA-1: b6549fbf7307adc14446cdd6c3bde4604bf2bd42
• MD5: 465266d02f83270f2c4b5264cb7e945b
• ssdeep: 1536:Lr5FW5bwmr+LW6XHMLTces+/Ww019FSXCkW8pO7iJCH:vW5ocLTcesv9F8C37j
• TLSH: T15037CFF32197ED4C778F9F0354E715A8A487E7886672EB500088B7AC89BC67E7E00951
• Submitted as: 90200862749.pdf
• File type: pdf · Size: 75083 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://prttour.ca/FileData/ckfinder/files/20210902_5A5613DCE2260F29.pdf, http://meditopthailand.com/file/93391806599.pdf, https://www.bnbtravels.com/ckfinder/userfiles/files/85158874237.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=sword+and+sandals+2+redux
• http://prttour.ca/FileData/ckfinder/files/20210902_5A5613DCE2260F29.pdf
• http://meditopthailand.com/file/93391806599.pdf
• https://www.bnbtravels.com/ckfinder/userfiles/files/85158874237.pdf
• http://chi-kara.net/Upload/files/zuloromanuwulavez.pdf
• http://apexibd.com/uploads/fck_uploads/file/kosijovubimexaduzunedur.pdf
• http://mawaevents.com/uploads/file/kezomixa.pdf
• http://tamtamphat.com/upload/files/gaxojozelifax.pdf
• https://www.hkha.com.hk/ckfinder/userfiles/files/zoxuw.pdf
• http://master-br.ru/img/file/5432582452.pdf
• http://e-junghan.com/userData/board/file/bafunolutotuzix.pdf
• https://sharzh-ufa.ru/wp-content/plugins/super-forms/uploads/php/files/342640b10ad53008afa33db010b4b54c/72670410174.pdf
• http://vinaktv.com/storage/ckfinder/files/74573867340.pdf
• http://gostinica-domodedovo.ru/files/86783359090.pdf
• http://phuketdriveschool.com/userfiles/file/99907629680.pdf
• http://studiosimonepantaleo.it/userfiles/files/79709587798.pdf
• https://sellos-mecanicos.com/wp-content/plugins/super-forms/uploads/php/files/fc26af20b394ed096d0a69ae710df6f8/doloziwudojipaleba.pdf
• https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/16136ca848dbb1---55897321381.pdf
• http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/qme6pk5phucq576frja7qk1535/sexofofarapagapubikej.pdf
• https://cargotavio.ru/files/file/zaroniwoxefosubozev.pdf
• https://joefairless.com/wp-content/plugins/super-forms/uploads/php/files/b91be4d0769d399046b4d236278f7131/61717441699.pdf
• https://drproperty.in/userfiles/file/nisadulojajuterikiwolote.pdf
• http://mawaevents.com/uploads/file/didov.pdf
• https://www.financedeclined.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1613ad6518b36e---sexisedoxo.pdf
• http://naturalmis.com/userfiles/file/81372699728.pdf

Embedded domains

• feedproxy.google.com
• prttour.ca
• meditopthailand.com
• www.bnbtravels.com
• chi-kara.net
• apexibd.com
• mawaevents.com
• tamtamphat.com
• www.hkha.com.hk
• master-br.ru
• e-junghan.com
• sharzh-ufa.ru
• vinaktv.com
• gostinica-domodedovo.ru
• phuketdriveschool.com
• studiosimonepantaleo.it
• sellos-mecanicos.com
• cffcommunications.nl
• www.sunarnuricomuisvealisverismerkezi.com
• cargotavio.ru
• joefairless.com
• drproperty.in
• www.financedeclined.com.au
• naturalmis.com
• mecateengenharia.com.br

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report