MALICIOUS — 68494555222.pdf

MALICIOUS — 68494555222.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 200f85028b71eedc690ee0d12a002066dbd37982a25c5726d9126a2f18d694d4
• SHA-1: 626aa2ab37a470bcd5ad249777967c600bd051b0
• MD5: e57c9e6c33a571ad390f8133406cdc14
• ssdeep: 1536:iHFyM6Q31Ti24n5bDniWhFbuLM6XsBb/SJ/d1sp/w00ojCJhHG:OFl6Q31TV4BPhFbusBb/G/Iw00uCJs
• TLSH: T1F938D0F350DBCD4C354AAB13AAEF106C74C9E7C06432D5B49494FE2E94A87AEBE10911
• Submitted as: 68494555222.pdf
• File type: pdf · Size: 80033 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!E57C9E6C33A5
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://nomylo.ru/uplcv?utm_term=ni+no+kuni+wrath+of+the+white+witch+ps4+trophy+guide, https://www.qbuildsoftware.com/wp-content/plugins/super-forms/uploads/php/files/e5b75d3053ab79cedfb52853b4585e40/rijomepabavutuv.pdf, http://dlt-nkp.com/fileupload//file/39625576137.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://nomylo.ru/uplcv?utm_term=ni+no+kuni+wrath+of+the+white+witch+ps4+trophy+guide
• https://www.qbuildsoftware.com/wp-content/plugins/super-forms/uploads/php/files/e5b75d3053ab79cedfb52853b4585e40/rijomepabavutuv.pdf
• http://dlt-nkp.com/fileupload//file/39625576137.pdf
• http://shmountaineering.co.uk/wp-content/plugins/super-forms/uploads/php/files/tljsbt7nt177mcne3i7nmciqa7/nosumajezazoge.pdf
• http://hitecds.com/userfiles/file/nopopevuxejuzokafaruw.pdf
• https://rclurie.com/wp-content/plugins/super-forms/uploads/php/files/087dcc0d2d329338b259dcf28fed50c5/13220892716.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160867b543321b---79650945945.pdf
• https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609edec877718---91711804783.pdf
• https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/160c28841d1b50---60246197021.pdf
• http://www.loicadesacavem.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1609628be40936---39543712978.pdf
• http://kino-profi.com/wp-content/plugins/super-forms/uploads/php/files/42f05cf098c5af9441553f65fce11cd7/womazefujigafe.pdf
• http://nuitsdartistes.eu/images/file/64921237518.pdf
• http://makaeximworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba6baa7afee---57193446465.pdf
• http://madmojo.com/fckupload/file/19468822112.pdf
• http://sciencevier.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ce44ccf1ba---luliber.pdf
• http://dok-vo.ru/userfiles/file/jegomatirixosuxunodov.pdf
• http://photographybynami.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080929ce3543---12127577189.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• nomylo.ru
• www.qbuildsoftware.com
• dlt-nkp.com
• shmountaineering.co.uk
• hitecds.com
• rclurie.com
• www.1000ena.com
• www.simplythebestevents.ca
• kino-profi.com
• nuitsdartistes.eu
• makaeximworld.com
• madmojo.com
• sciencevier.com
• dok-vo.ru
• photographybynami.com
• i.io
• www.w3.org
• purl.org
• ns.adobe.com
• www.web2business.pt
• www.loicadesacavem.pt

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report