MALICIOUS — 7f1d73_df51e32450b24d4da31cc0a4beee8630.pdf

MALICIOUS — 7f1d73_df51e32450b24d4da31cc0a4beee8630.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

SHA-256: 2858126a578d2b29e8901338fb48635f88ea46ee14d9e1e39277a5b3169b5947
SHA-1: 2defbdf4701000b6e7942f2b90bf888a348bb795
MD5: 230b410cfad882cf1a4997bb7bb65a50
ssdeep: 1536:O9VGQ04DHyprwOGwUDYn/SQ24G1PXVxrYCaRpPUUUbQBU:IFIfoDwb2RPvrYJPUUUbl
TLSH: T15737D0FBA197DC4CB6CF8B433DBB042D4486D7886933865058C4A26DC8BC3AD2F20942
Submitted as: 7f1d73_df51e32450b24d4da31cc0a4beee8630.pdf
File type: pdf · Size: 74488 bytes
Verdict: malicious (92/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!230B410CFAD8

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://resalured.ru/wix?keyword=congruent+triangle+worksheet+pdf, http://nudewewupapu.epizy.com/ford_explorer_transmission_fluid_change_cost.pdf, http://forawoxo.epizy.com/srimad_bhagavatam_malayalam_free.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://resalured.ru/wix?keyword=congruent+triangle+worksheet+pdf
http://nudewewupapu.epizy.com/ford_explorer_transmission_fluid_change_cost.pdf
http://forawoxo.epizy.com/srimad_bhagavatam_malayalam_free.pdf
http://tasefabomodewiv.epizy.com/bankers_adda_current_affairs_one_liners.pdf
http://fotizojorirepel.onlinewebshop.net/86071600337.pdf
http://1green.space/63229339051cazub.pdf
http://fanulegosupilul.rf.gd/how_to_find_the_exterior_measure_of_a_triangle.pdf
http://wasaxeradiko.rf.gd/google_chrome_vpn_extension.pdf
http://bolozenafo.rf.gd/67285895966.pdf
http://stebsmeh.space/how_to_know_reading_levelmcbxz.pdf
http://gupupokuvugal.22web.org/61543382622.pdf
http://rekipeva.iblogger.org/migegetasevabux.pdf
http://fresh-ita.fun/lic_-_life_insurance_corporation_of_india_mysore_karnataka7m03j.pdf
https://cdn-cms.f-static.net/uploads/4413987/normal_600b0e3da3e9d.pdf
http://vagokij.iblogger.org/59759387248.pdf
http://xasagofawidi.epizy.com/83609843522.pdf
http://pawezujexas.mywebcommunity.org/93631298087.pdf
http://tokigarodam.22web.org/82714295639.pdf
http://gepexoliv.medianewsonline.com/72338217126.pdf
http://mosepurone.epizy.com/hulu_on_sony_blu_ray_player.pdf
http://help-bluebadgecenter.com/how_long_to_steam_broccoli_in_electric_steamer1dzt4.pdf
https://static.s123-cdn-static.com/uploads/4388412/normal_60053288db77e.pdf
http://jabujiwotase.epizy.com/32396259308.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

resalured.ru
nudewewupapu.epizy.com
forawoxo.epizy.com
tasefabomodewiv.epizy.com
fotizojorirepel.onlinewebshop.net
1green.space
stebsmeh.space
gupupokuvugal.22web.org
rekipeva.iblogger.org
fresh-ita.fun
cdn-cms.f-static.net
vagokij.iblogger.org
xasagofawidi.epizy.com
pawezujexas.mywebcommunity.org
tokigarodam.22web.org
gepexoliv.medianewsonline.com
mosepurone.epizy.com
help-bluebadgecenter.com
static.s123-cdn-static.com
jabujiwotase.epizy.com
www.w3.org
purl.org
ns.adobe.com
fanulegosupilul.rf.gd
wasaxeradiko.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report