MALICIOUS — 16099e2617cacd---sofogikifetapa.pdf

MALICIOUS — 16099e2617cacd---sofogikifetapa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 22a78fc45520530a206a6319019f7004465fae7a4d797a25ac3945d763ec2377
• SHA-1: 4c0667981b422b077854db52d545183649ff7b10
• MD5: 3ba1ae3d1ca8e1746114e8a8a343eb25
• ssdeep: 1536:YQDxTYTw/evkDXQIVOwGVEQvy0NjsJ+WYQss72Qsmwsj:ZDxCcDXQkO9VEQUHYQss72DOj
• TLSH: T10637D0F7A187DD8CB28BAB133E95653D7089D38931A2E7A85484F39CC0BC6BD6D10950
• Submitted as: 16099e2617cacd---sofogikifetapa.pdf
• File type: pdf · Size: 70385 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!3BA1AE3D1CA8
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://windcampus.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a46242a093---43984668601.pdf, http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/k0h0ikm978tlvd04o4kaqssut0/93359947020.pdf, http://grupomarsamo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082a9c7e0ab5---kivekojirijiletaje.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=joyous+celebration+sheet+music
• http://windcampus.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a46242a093---43984668601.pdf
• http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/k0h0ikm978tlvd04o4kaqssut0/93359947020.pdf
• http://grupomarsamo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082a9c7e0ab5---kivekojirijiletaje.pdf
• http://www.catalogodecineargentino.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099d721021b4---46323210260.pdf
• https://accesoriosalmayor.com/images/userfiles/file/vikobusafubotide.pdf
• https://naseeha.org/wp-content/plugins/super-forms/uploads/php/files/e8e024c310eb795f36275b188b4b35e0/74583711433.pdf
• https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/16086e651dcd58---lubumagulanop.pdf
• https://skazkavdom.com/wp-content/plugins/super-forms/uploads/php/files/397da674fce4c7ad54665088aabab67a/38681477383.pdf
• https://aliencosmicexpo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160749236e595c---73316614272.pdf
• https://acronimocostanzo.com/userfiles/file/birejevopemo.pdf
• http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/160840fba05633---21759458481.pdf
• http://churchliferesources.org/wp-content/plugins/formcraft/file-upload/server/content/files/160856ddbe3c54---vorunaxobetosunuwodiforeb.pdf
• http://ersatzmonitor.de/userfiles/file/53093399754.pdf
• http://allegroescrow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f428028674---77159070929.pdf
• http://al-bandak.com/userfiles/file/nagowevasagu.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• windcampus.com
• www.x454.com
• grupomarsamo.com
• www.catalogodecineargentino.com
• accesoriosalmayor.com
• naseeha.org
• mamproducciones.es
• skazkavdom.com
• aliencosmicexpo.com
• acronimocostanzo.com
• churchliferesources.org
• ersatzmonitor.de
• allegroescrow.com
• al-bandak.com
• www.w3.org
• purl.org
• ns.adobe.com
• gsoam.ge

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report