MALICIOUS — 71787690337.pdf

MALICIOUS — 71787690337.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 31402a973230b5a7e0865bef2b992ead221ffd09c8d2e4b4734e546f0d9bf139
• SHA-1: f4ada48a65e63f9864733f4d4be2cca3fc68ffdd
• MD5: b04774e7bfd598c4786ea515a6163093
• ssdeep: 1536:Dd6RpQ/vc6vGP4q6H8LmWFnZQilCGOkUlyUpkI4cWGpOKCWsLusu3uhtuDKOF:IQM3P4q6H8tmilCGOkQyhIkKyasu3uhO
• TLSH: T10139D1F3619BDD9C734B8B5369BB42AC7489E3885263DE804088767D94BC5BCEF40902
• Submitted as: 71787690337.pdf
• File type: pdf · Size: 86465 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://kirbas.com/img/uploaded/file/merexokipuj.pdf, https://yam-token.com/business_school/uploads/file/18276026349.pdf, https://hainutedecopii.eu/ckfinder/userfiles/files/mokadujesedazaruk.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=n+se+word
• https://kirbas.com/img/uploaded/file/merexokipuj.pdf
• https://yam-token.com/business_school/uploads/file/18276026349.pdf
• https://hainutedecopii.eu/ckfinder/userfiles/files/mokadujesedazaruk.pdf
• https://sfasg.jp/js/ckfinder/userfiles/files/debosaxotuwepazanidubu.pdf
• https://lazeo.nl/userfiles/file/lokulafis.pdf
• http://portalpr-b2b.es/img/user//file/_0305410001630874551.pdf
• http://tyextractor.com/d/files/barabekolipagenobe.pdf
• http://ff-engineering.com/userfiles/files/tupobutux.pdf
• https://assurancemauricie.com/wp-content/plugins/formcraft/file-upload/server/content/files/16141c18f23033---jupizunib.pdf
• https://xtrafitcoaching.com/www/images/files/32027056396.pdf
• https://sodigital.it/wp-content/plugins/formcraft/file-upload/server/content/files/1613db537d9c5f---27836729486.pdf
• http://master-br.ru/img/file/pumefopovixapobozo.pdf
• https://afritransport.com/app/webroot/files/file/dikowagebixozav.pdf
• https://sevsport.info/wp-content/plugins/super-forms/uploads/php/files/9f4e8574b210619d37717f418d6b3f3b/20542803381.pdf
• https://eurosan.pl/user_images/file/41492272577.pdf
• https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/sq8kpme8hr773afvpt6altbial/66989843473.pdf
• https://unibel.pl/pliki/upload/file/12315652302.pdf
• http://novastal.pl/userfiles/file/96920208952.pdf
• https://www.xcelsus.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613ed4cc62ac0---35084773912.pdf
• http://cmuniontravel.com/userfiles/file/73114596277.pdf
• http://phunphu.com/userfiles/file/68764830799.pdf
• http://anhuizpyy.com/upload_fck/file/2021-9-16/20210916085939261708.pdf
• http://pune-india.info/userfiles/file/wafokivixuvudiko.pdf
• https://barrierball.cl/ckfinder/userfiles/files/gokatipamotijo.pdf

Embedded domains

• feedproxy.google.com
• kirbas.com
• yam-token.com
• hainutedecopii.eu
• sfasg.jp
• lazeo.nl
• portalpr-b2b.es
• tyextractor.com
• ff-engineering.com
• assurancemauricie.com
• xtrafitcoaching.com
• sodigital.it
• master-br.ru
• afritransport.com
• sevsport.info
• eurosan.pl
• heritagelogs.com
• unibel.pl
• novastal.pl
• www.xcelsus.de
• cmuniontravel.com
• phunphu.com
• anhuizpyy.com
• pune-india.info
• desushibar.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report