MALICIOUS — 2e8ee504735adf10899749f43cb06a263f16c3f20ae45db3ade3f03f59faa4df

MALICIOUS — 2e8ee504735adf10899749f43cb06a263f16c3f20ae45db3ade3f03f59faa4df is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 2e8ee504735adf10899749f43cb06a263f16c3f20ae45db3ade3f03f59faa4df
• SHA-1: 4a4533d459be4c1db288934d70ffc35e50cd8449
• MD5: b0019d8baf87472503629b2e58b9d7af
• ssdeep: 3072:+C1TFdYB/TBsf3E4ASvtGuA6OyNGsS+cVJ5rnNZ6S:N1/YBHHSVu6EDf
• TLSH: T16E3BD0F36163DC8CBA8ADB0764E62198754DE7C431A2FE504888766CC5FC6BEBE04611
• Submitted as: 2e8ee504735adf10899749f43cb06a263f16c3f20ae45db3ade3f03f59faa4df
• File type: pdf · Size: 104959 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://medvor.ru/uplcv?utm_term=play+along+quotes, https://ssekolkata.com/ckfinder/userfiles/files/zomoduwezinaviwivimigizip.pdf, http://vincentianssjp.com/userfiles/file/boserisuwewura.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://medvor.ru/uplcv?utm_term=play+along+quotes
• https://ssekolkata.com/ckfinder/userfiles/files/zomoduwezinaviwivimigizip.pdf
• http://vincentianssjp.com/userfiles/file/boserisuwewura.pdf
• https://galaxy-training.com/userfiles/file/8347261696.pdf
• https://booburger.myagenda.cz/pictures/editor/files/34759371434.pdf
• https://xaydungdonggia.com/app/webroot/files/images/pages/files/tapivedurufavubilabok.pdf
• http://boletos.luzservicos.com/ckfinder/userfiles/files/38803367738.pdf
• http://eoffice.erdenet.mn/asu/editor/files/98941756053.pdf
• https://ihotel2b.com/upfiles/editor/files/zujujiwalisidutiwubeg.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614a088f0b8b2---nobozekivebepepodomex.pdf
• http://studioghittigargnano.com/userfiles/files/zewoluzidesupibimatokasuz.pdf
• https://paysecure.ro/ckfinder/userfiles/files/17604007689.pdf
• https://aedwea.com/upload/foto/33178562156.pdf
• https://www.jahnigterbraak.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1614b05e1f0ef8---27553240390.pdf
• http://rosg.net/sa_upload/userfiles/file/20210918040639.pdf
• http://instalater-macecek.cz/klienti/devel/sneznerolby.cz/ckfinder/userfiles/files/56622160338.pdf
• http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/16146d92c92aa0---39213414262.pdf
• http://fulepmark.hu/nyebu/fulepmark/userfiles/file/wogawupiga.pdf
• https://www.truck-transport.com/ckfinder/userfiles/files/munurinerululisufupix.pdf
• https://felicitareonline.ro/ckfinder/userfiles/files/28976932637.pdf
• https://phucatgarment.com.vn/ckfinder/userfiles/files/tofijuxalimubejekeb.pdf
• http://uzmansporzeminkaplama.com/resimler/files/489196675.pdf
• http://meadescafe.com/userfiles/file/dudezofibo.pdf
• http://tdvvietnam.vn/webroot/img/files/vapujudutin.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• medvor.ru
• ssekolkata.com
• vincentianssjp.com
• galaxy-training.com
• xaydungdonggia.com
• boletos.luzservicos.com
• ihotel2b.com
• www.1000ena.com
• studioghittigargnano.com
• aedwea.com
• www.jahnigterbraak.nl
• rosg.net
• krindustria.com.br
• www.truck-transport.com
• uzmansporzeminkaplama.com
• meadescafe.com
• www.w3.org
• purl.org
• ns.adobe.com
• booburger.myagenda.cz
• eoffice.erdenet.mn
• paysecure.ro
• instalater-macecek.cz
• fulepmark.hu
• felicitareonline.ro

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report