MALICIOUS — 1830534.pdf

MALICIOUS — 1830534.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

SHA-256: 15d75ccf8b14824d689c0dde8e07721faf8ce74825bb4192df5b532ad195b8b3
SHA-1: 5a1a5631d5e3eb97d4819a8c39f835b76140b745
MD5: cbfbc83290b3278b1c92157b16c79d41
ssdeep: 1536:AOqcK0PzVzrRzRYzTDzOeAVeXzWku2JA2j85ybL82LLx82DW:vqcKIrRzCTDzCiWknr3td8T
TLSH: T17E37CFE3B507EE8C735E9B9B29EB101D6049D39C703297945088B76CC4BC2BE9E10A51
Submitted as: 1830534.pdf
File type: pdf · Size: 72352 bytes
Verdict: malicious (92/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://cctraff.ru/wb?keyword=letter%20of%20recommendation%20for%20employment%20template, https://static1.squarespace.com/static/5fc6449c6b97992eb5800a9b/t/5fd5f11189566e781f4415f3/1607856401586/vowupanaguzasobotesamude.pdf, https://suleduzon.weebly.com/uploads/1/3/4/4/134403341/panetelojopu-neduveretij.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://cctraff.ru/wb?keyword=letter%20of%20recommendation%20for%20employment%20template
https://static1.squarespace.com/static/5fc6449c6b97992eb5800a9b/t/5fd5f11189566e781f4415f3/1607856401586/vowupanaguzasobotesamude.pdf
https://suleduzon.weebly.com/uploads/1/3/4/4/134403341/panetelojopu-neduveretij.pdf
https://tofuxatedev.weebly.com/uploads/1/3/4/7/134706151/virelut.pdf
https://uploads.strikinglycdn.com/files/e0a3a8d7-383d-4f04-b3db-aa2e4e1160d7/gunship_strike_3d_mod_apk_happymod.pdf
https://static1.squarespace.com/static/5fc1480d27a199023ab7f389/t/5fc4a5ec173fb5383b373830/1606723052427/criminal_law_and_procedure_notes.pdf
https://s3.amazonaws.com/nowokil/xoweriguninime.pdf
https://uploads.strikinglycdn.com/files/ae8b9462-401a-4e0f-b68b-d7b06fbb57ec/65148716869.pdf
https://s3.amazonaws.com/xedewofuretujo/ranofenerire.pdf
https://rofexigu.weebly.com/uploads/1/3/0/7/130738805/sipugixeseranelofi.pdf
https://nesutidixet.weebly.com/uploads/1/3/4/7/134724555/0a947bd9.pdf
https://vuxilimibipemop.weebly.com/uploads/1/3/1/4/131453056/zuwitetujewo.pdf
https://static1.squarespace.com/static/5fbffea5239b0722912c2f3a/t/5fc158569ee0f32b87851e2c/1606506583160/mivilinutet.pdf
https://tajedapen.weebly.com/uploads/1/3/4/3/134373213/3872454.pdf
https://vajoribenokajug.weebly.com/uploads/1/3/4/7/134713142/6ccb6e624399.pdf
https://pifujikis.weebly.com/uploads/1/3/4/8/134875168/38146c.pdf
https://mexunavogowa.weebly.com/uploads/1/3/4/8/134887210/5181547.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

tg.ir
cctraff.ru
static1.squarespace.com
suleduzon.weebly.com
tofuxatedev.weebly.com
uploads.strikinglycdn.com
s3.amazonaws.com
rofexigu.weebly.com
nesutidixet.weebly.com
vuxilimibipemop.weebly.com
tajedapen.weebly.com
vajoribenokajug.weebly.com
pifujikis.weebly.com
mexunavogowa.weebly.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report