MALICIOUS — 87300490473.pdf

MALICIOUS — 87300490473.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 31e43789224711d853664086f2d02bb2c8dd33e30f8f6bafd73837b22b7ff93c
• SHA-1: 03cd611900080048949f539a9abfb5e9bd344b3f
• MD5: ecced681b8fdc92bb9eeaf74edd06ce7
• ssdeep: 1536:ovB+MK1EdRR4dBnad/EZtiX6zmpyrZwq+2290eH8Pr:q4YRR4dQdMPiX6zmKeHuoc
• TLSH: T1E437CFF36097DE4C7A97AB57A2E3406C258ED68C2163E768448C2B2CC5BC27C7F15912
• Submitted as: 87300490473.pdf
• File type: pdf · Size: 71792 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!ECCED681B8FD
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://crysiq.ru/uplcv?utm_term=adverb+clause+of+sentences, http://ifa-astrologie.de/userfiles/file/11686733327.pdf, https://adlinefor.com/home/webagen/public_html/korn/data/file/sedoxuzofa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://crysiq.ru/uplcv?utm_term=adverb+clause+of+sentences
• http://ifa-astrologie.de/userfiles/file/11686733327.pdf
• https://adlinefor.com/home/webagen/public_html/korn/data/file/sedoxuzofa.pdf
• https://www.asahinadigital.com/wp-content/plugins/super-forms/uploads/php/files/ocf118crgsemvj77urerjsojhq/wipujupofawinubotutavo.pdf
• https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/7b1bd8f3146eba792d6a2fdaa277416c/fipov.pdf
• http://svs-pm.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ea7d39f68c---62310400447.pdf
• http://www.thebetterinsurance.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608095310047b---foxidukiga.pdf
• http://bright-mineral.com/uploadfile/file/2021052008495975.pdf
• https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f387d82d6b---45288213520.pdf
• http://grani-tonkogo-mira.ru/wp-content/plugins/super-forms/uploads/php/files/b04d7058a5fba8a95d141d2f451d4490/77240207092.pdf
• http://accessiblevehicleservices.com/userfiles/file/13880039213.pdf
• http://bubblesoflove.net/wp-content/plugins/formcraft/file-upload/server/content/files/1609d1ebdb06db---zefagemegi.pdf
• https://bnbcostaverde.it/userfiles/file/50065998386.pdf
• https://www.lang-mayer.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609e5272f1bcf---37084218262.pdf
• http://herodumpsterrental.com/wp-content/plugins/super-forms/uploads/php/files/aee05f30bb08e37bd2e5ef8e91208c9d/41188070530.pdf
• https://paperland.bg/uploads/file/59548813199.pdf
• http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609cdf4b3168f---88349689344.pdf
• https://www.idahomedia.com/wp-content/plugins/super-forms/uploads/php/files/7c43ea4faddd8e0eccf35ec6a1461912/lebapijafox.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• crysiq.ru
• ifa-astrologie.de
• adlinefor.com
• www.asahinadigital.com
• mkting.com.co
• svs-pm.com
• www.thebetterinsurance.com
• bright-mineral.com
• www.modianodesign.com
• grani-tonkogo-mira.ru
• accessiblevehicleservices.com
• bubblesoflove.net
• bnbcostaverde.it
• www.lang-mayer.de
• herodumpsterrental.com
• www.canadiantreasurer.com
• www.idahomedia.com
• www.w3.org
• purl.org
• ns.adobe.com
• paperland.bg

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report