MALICIOUS — 71248134343.pdf

MALICIOUS — 71248134343.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 1f321a4f5c4c0b17e7cade50c459cbf7027b11c5f0b70e71c6f018d0a89e19ea
• SHA-1: 52fb026d87073839fe49cbe642382d71977b2156
• MD5: 0fbf4decc9cb488a3815dd25e92be2f7
• ssdeep: 1536:ba6dLWTAElV2pAxktkHIZQQ0Uv1pvC3BoeO/HhbRdqbj0AmRBt5KK4qqxbM60Gvu:l1+cpAIQQhv1pvC3BoesRdqbjfmRBt5v
• TLSH: T11838DFF39427DD0CEB8B6B43AAFA14385645C75D6223D66454C8F2ACDAF837C9E01A01
• Submitted as: 71248134343.pdf
• File type: pdf · Size: 80913 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!0FBF4DECC9CB
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://drafthe.ru/uplcv?utm_term=how+to+use+hoover+steamvac+widepath+ls, http://uro-medical.pl/zdjecia/fotki/file/72544161792.pdf, https://thewentworthco.com/wp-content/plugins/super-forms/uploads/php/files/i1v4cr2s5m7agnr9qr55lchcns/fapimejepefin.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://drafthe.ru/uplcv?utm_term=how+to+use+hoover+steamvac+widepath+ls
• http://uro-medical.pl/zdjecia/fotki/file/72544161792.pdf
• https://thewentworthco.com/wp-content/plugins/super-forms/uploads/php/files/i1v4cr2s5m7agnr9qr55lchcns/fapimejepefin.pdf
• https://kolodezrus.ru/wp-content/plugins/super-forms/uploads/php/files/b1971ce2b6729534333b6705a3c32f27/wenivozumiju.pdf
• http://www.combatsim.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160bb284442979---4167293707.pdf
• http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/160823035a5b8a---70076162284.pdf
• https://space1500.com/wp-content/plugins/super-forms/uploads/php/files/f3cc0d60e56d67eaa465fcbb2751939f/70334114340.pdf
• http://mirandatutoringcentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160add287ec903---36918982190.pdf
• http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/nkjohm2pfgkbh29f55t1me5j9b/87817087099.pdf
• http://sam-global.info/files/file/sizeseg.pdf
• http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/4f292f38b5f1c862c4bc9bba01f0f870/xufomavamumaz.pdf
• https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/dfm55vt3uctok5625uhfb7hc3h/74286288995.pdf
• http://www.nandomoraes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16071de9d34a48---xasor.pdf
• http://trenermichal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1607236412bbeb---jenajilasuwikagomarub.pdf
• http://www.unidacardoso.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b1f6eecbd50---83866338579.pdf
• https://pousadamarazul.tur.br/wp-content/plugins/formcraft/file-upload/server/content/files/160884262e5372---rimamutidifobumurodig.pdf
• http://ajivikafinance.com/userfiles/file/30215983197.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• drafthe.ru
• uro-medical.pl
• thewentworthco.com
• kolodezrus.ru
• www.combatsim.eu
• trackeg.com
• space1500.com
• mirandatutoringcentre.com.au
• pebyte.com
• sam-global.info
• www.rec39.ru
• www.nandomoraes.com.br
• trenermichal.pl
• www.unidacardoso.com.br
• pousadamarazul.tur.br
• ajivikafinance.com
• www.w3.org
• purl.org
• ns.adobe.com
• alcc.vn

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report