MALICIOUS — 48da0.pdf

MALICIOUS — 48da0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 2abce3c6aea3e130c5899e04bc7ce8ca3d40016feee6950692ecf9214696a486
• SHA-1: c2c3164e616b264999c38d9993f87ac874f7ec5f
• MD5: 3dea8697efc86129e0fa2f3798f9da16
• ssdeep: 1536:pGqmCA/9cYFFaW/QiPuJTPNvNixfjPncZL/uckgTQvhxM:Eqe/DnaW9PudPlNwjk/u5gkvrM
• TLSH: T19437C0F3A29BEE8C2794AB037DA61579148AEB4C6132CA5640843F7DC5B89BD3F10911
• Submitted as: 48da0.pdf
• File type: pdf · Size: 69782 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffking.ru/wb?keyword=best%20bluetooth%20earphones%20for%20android%20in%20india, https://xiletepegokif.weebly.com/uploads/1/3/4/3/134319576/talavevituxonazupaku.pdf, https://dirigesibujov.weebly.com/uploads/1/3/0/9/130969991/6583597.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffking.ru/wb?keyword=best%20bluetooth%20earphones%20for%20android%20in%20india
• https://xiletepegokif.weebly.com/uploads/1/3/4/3/134319576/talavevituxonazupaku.pdf
• https://s3.amazonaws.com/kezemiradigu/math_worksheets_grade_8_exponents.pdf
• https://s3.amazonaws.com/wizuluworafid/jasudemizedokidaliregono.pdf
• https://s3.amazonaws.com/zuxadol/19840306108.pdf
• https://s3.amazonaws.com/wefadep/60840648756.pdf
• https://dirigesibujov.weebly.com/uploads/1/3/0/9/130969991/6583597.pdf
• https://s3.amazonaws.com/selivuvumepaveb/23126771018.pdf
• https://s3.amazonaws.com/fukepez/78285468402.pdf
• https://cdn-cms.f-static.net/uploads/4370264/normal_5f9fa0548bff0.pdf
• https://vafumigoku.weebly.com/uploads/1/3/1/3/131384305/4397584.pdf
• https://cdn-cms.f-static.net/uploads/4487413/normal_5fab66b2f2d3f.pdf
• https://s3.amazonaws.com/memobofilenabon/19907237593.pdf
• https://xejibojap.weebly.com/uploads/1/3/4/3/134310503/rudal_lomuzabivok_jumamumuw.pdf
• https://xujaxivef.weebly.com/uploads/1/3/1/4/131438557/8b7ed9afed.pdf
• https://s3.amazonaws.com/rakabexozu/81165467886.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffking.ru
• xiletepegokif.weebly.com
• s3.amazonaws.com
• dirigesibujov.weebly.com
• cdn-cms.f-static.net
• vafumigoku.weebly.com
• xejibojap.weebly.com
• xujaxivef.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report