MALICIOUS — 44831036804.pdf

MALICIOUS — 44831036804.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

SHA-256: 2a8c168a8cdce5a73041f43788da2e83306dc367e64e9eb82d9d53fdc7c50e88
SHA-1: 1f27b3f88585cd9f6d3ed9210bcd7fa494d8479f
MD5: baa8239f1b0cb0d94733dacf5eb32ad6
ssdeep: 1536:3giTruSV646EwpnHex/43f+jewlKur3vrGaoS25oxc+t1AZe:gSdYeO3fkTb+u25omA1H
TLSH: T1F137CFF7A09BDE8CB5969F0369E76018644AE3C82571A6B448C8B37C817C6BD7D40B90
Submitted as: 44831036804.pdf
File type: pdf · Size: 73583 bytes
Verdict: malicious (92/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!BAA8239F1B0C
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://wastran.ru/uplcv?utm_term=tokyo+ghoul+mods+minecraft, https://www.movingwithmagna.com/wp-content/plugins/super-forms/uploads/php/files/09cb4fa885aa964060fa4b4af54a5c40/goxutuxojitizemi.pdf, http://blessedfamilycovenant.org/clients/c/cb/cb727bc273eb4203dc66fb73741ae5ae/File/68099920183.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://wastran.ru/uplcv?utm_term=tokyo+ghoul+mods+minecraft
https://www.movingwithmagna.com/wp-content/plugins/super-forms/uploads/php/files/09cb4fa885aa964060fa4b4af54a5c40/goxutuxojitizemi.pdf
http://blessedfamilycovenant.org/clients/c/cb/cb727bc273eb4203dc66fb73741ae5ae/File/68099920183.pdf
http://deborahkay.com/ckfinder/userfiles/files/94083106239.pdf
http://gilbertthomasreunion.com/clients/5/5f/5f56fe696be94dde62972871c8a9bc28/File/33477788675.pdf
https://securityguardsupply.org/php/uploads/file/17208716453.pdf
http://coumert.com/images/file/10353219204.pdf
https://sellos-mecanicos.com/wp-content/plugins/super-forms/uploads/php/files/f2d32b73a24a47cb913422c98d0b8ba7/11905701145.pdf
http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609847f6ab7c2---77943435137.pdf
https://thejasmineway.net/wp-content/plugins/super-forms/uploads/php/files/dha7l6vc91ies2duv7b0hv6lph/52752108765.pdf
https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608609f5a91d1---56097539836.pdf
http://romanakladatelstvi.cz/userfiles/file/28234493383.pdf
http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607616e309b2c---vobojodemizineg.pdf
http://www.virtualaid.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160856e97ac4c3---nekubo.pdf
https://angkorphotographyguide.com/userfiles/file/pulabawasavaxojefokosoti.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

wastran.ru
www.movingwithmagna.com
blessedfamilycovenant.org
deborahkay.com
gilbertthomasreunion.com
securityguardsupply.org
coumert.com
sellos-mecanicos.com
www.1000ena.com
thejasmineway.net
cutletsmeat.com
a-range.ru
www.virtualaid.eu
angkorphotographyguide.com
www.w3.org
purl.org
ns.adobe.com
romanakladatelstvi.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report