MALICIOUS — 2ac701_a218d2eb36e94c388dbfaa6955ab4a69.pdf
MALICIOUS — 2ac701_a218d2eb36e94c388dbfaa6955ab4a69.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.
Identification
- SHA-256:
152dcca38043c26b54c2a4da538878ca59dd62bb9bec4932224fb801063f63ba - SHA-1:
8fcf1263e01939c7c6aa13a9fde5541143c6e2cf - MD5:
13fb38cc9515b08e174246a286108dc6 - ssdeep:
1536:/Ve0/2vfuxSsa7cC8dGngNkXB6NOO912dbatvgrmkqMDL:PYx7F8sIcnOKdqvgrDqy - TLSH:
T1E436E0F36167DD8C7A85AF53ADFB18446C46EA847233CAA044C87BAD847C5BD7E00A11 - Submitted as: 2ac701_a218d2eb36e94c388dbfaa6955ab4a69.pdf
- File type: pdf · Size: 67181 bytes
- Verdict: malicious (92/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!13FB38CC9515
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://leonvi.ru/wix?keyword=samsung+scs-2u01+power+supply, http://skameyki.club/xixogigug78cu.pdf, https://vagipirisixo.weebly.com/uploads/1/3/4/8/134861957/rukepojiziw.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://leonvi.ru/wix?keyword=samsung+scs-2u01+power+supply
- http://skameyki.club/xixogigug78cu.pdf
- https://vagipirisixo.weebly.com/uploads/1/3/4/8/134861957/rukepojiziw.pdf
- http://bakotege.rf.gd/esc_guideline_heart_failure.pdf
- http://loveantravel.xyz/agile_project_management_tools_listu2xvq.pdf
- https://s3.amazonaws.com/lixisariwulo/aaru_songs_tamil.pdf
- http://thailandlove.site/bareilly_ki_barfi_movie_filmywap_hdhzffg.pdf
- https://lilafigofuku.weebly.com/uploads/1/3/1/3/131398347/reterolebi_lerufubek.pdf
- https://s3.amazonaws.com/rezugekolaba/surface_area_and_volume_of_triangular_prism_worksheet.pdf
- http://opendouche.xyz/meaning_of_dusk_till_dawn_curfew2sb8k.pdf
- http://nowutakifotekes.epizy.com/rulunosajumogudemive.pdf
- http://jisubumutowegur.22web.org/carnatic_music_free_sites.pdf
- https://jasesinokez.weebly.com/uploads/1/3/1/1/131164090/dajaxugemenoz.pdf
- https://s3.amazonaws.com/nufidibodudulad/acg_lower_gi_bleed_guidelines.pdf
- https://motonolezigit.weebly.com/uploads/1/3/2/8/132814123/12f64a6385.pdf
- https://tevufipe.weebly.com/uploads/1/3/1/6/131606546/cf2998e0eed3a1f.pdf
- http://5-euro.info/form_for_rbi_grade_b_201895cz2.pdf
- http://demask.space/52659715464lgndo.pdf
- https://wadasazaba.weebly.com/uploads/1/3/3/9/133999184/4145476.pdf
- http://detonic-buy.website/high_pointe_microwave_convection_oven_owners_manualhkma2.pdf
- https://xinuxarovota.weebly.com/uploads/1/3/0/7/130776268/vuwutigezu_jelelema_felisobufe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- leonvi.ru
- skameyki.club
- vagipirisixo.weebly.com
- loveantravel.xyz
- s3.amazonaws.com
- thailandlove.site
- lilafigofuku.weebly.com
- opendouche.xyz
- nowutakifotekes.epizy.com
- jisubumutowegur.22web.org
- jasesinokez.weebly.com
- motonolezigit.weebly.com
- tevufipe.weebly.com
- 5-euro.info
- demask.space
- wadasazaba.weebly.com
- xinuxarovota.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
- bakotege.rf.gd
- detonic-buy.website
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report