MALICIOUS — 0fa3c68e019c53172ce6f490b2c1e2c7ba68ad56833dcb52489dbad47d8b6cfa

MALICIOUS — 0fa3c68e019c53172ce6f490b2c1e2c7ba68ad56833dcb52489dbad47d8b6cfa is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 0fa3c68e019c53172ce6f490b2c1e2c7ba68ad56833dcb52489dbad47d8b6cfa
• SHA-1: a94d6656e3196e7910b2292676d4a4d30c8cb74e
• MD5: 381cf46076fbe0f62f2313c80bb5825d
• ssdeep: 1536:UmNuV0a2NGW7FJwGfT/xGpdITbsSFVW8VvJNEWQpOCKuW:QSa2AW7wajxGUb7FPJNDCK
• TLSH: T1C937DFF362ABCE4C769B4F4324E7112C6989E7985262EB9014C8777C853C6FD6F00A61
• Submitted as: 0fa3c68e019c53172ce6f490b2c1e2c7ba68ad56833dcb52489dbad47d8b6cfa
• File type: pdf · Size: 74233 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://coretry.ru/uplcv?utm_term=directions+to+dinkey+creek, http://consulcongress.it/uploads/assets/file/dinorivesezolitadekitijen.pdf, http://rasmesafar.net/basefile/basefiles/80964528416.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://coretry.ru/uplcv?utm_term=directions+to+dinkey+creek
• http://consulcongress.it/uploads/assets/file/dinorivesezolitadekitijen.pdf
• http://rasmesafar.net/basefile/basefiles/80964528416.pdf
• https://indiantalentjunction.com/milan/media/48411196220.pdf
• http://rimini-portal.de/bilderarchiv/file/39103480212.pdf
• https://www.tifdip.com/wp-content/plugins/formcraft/file-upload/server/content/files/161485e34cd786---21886939919.pdf
• http://feldbach-tourismus.at/files/venumefikuduzewakuwena.pdf
• http://sz-nuoyi.com/Upload/file/2021092615015597829.pdf
• http://execdentalclinic.com/uploads/ckfinder/userfiles/files/figebimizuwube.pdf
• http://hadt.vn/upload/files/degoxodezita.pdf
• http://hadt.vn/upload/files/69338922271.pdf
• https://edgecs.com/documents/xamewilaroromadegifob.pdf
• http://cieplej.pl/imgturysta/file/96748257351.pdf
• http://domesticsolutionsagency.com/userfiles/file/13219094894.pdf
• http://acevina.com/webroot/img/files/63596766941.pdf
• http://limuzine.md/userfiles/file/44399038264.pdf
• https://ecableapp.com/FCKeditor/FCKimgUpload/file/34816333473.pdf
• https://qian-ho.com/upfiles/editor/files/niwafabenam.pdf
• http://www.armstrongre.com/files/files/bujujokurev.pdf
• https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/16155aa1ddc7db---ruxomonewadu.pdf
• http://activesites.atiks.org/files/67935835352.pdf
• https://duocvinhkim.com/userfiles/file/kazugeget.pdf
• http://letsfinal.com/userfiles/file/galobixodizi.pdf
• http://gfb.it/upload/fck/file/kijubatogamidemopasa.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• coretry.ru
• consulcongress.it
• rasmesafar.net
• indiantalentjunction.com
• rimini-portal.de
• www.tifdip.com
• sz-nuoyi.com
• execdentalclinic.com
• edgecs.com
• cieplej.pl
• domesticsolutionsagency.com
• acevina.com
• ecableapp.com
• qian-ho.com
• www.armstrongre.com
• controlcert.se
• activesites.atiks.org
• duocvinhkim.com
• letsfinal.com
• gfb.it
• www.w3.org
• purl.org
• ns.adobe.com
• feldbach-tourismus.at
• hadt.vn

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report