MALICIOUS — 1a8813c983e7.pdf

MALICIOUS — 1a8813c983e7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 32c25eb2ce397f29bbba71e392ab17d5280e5ca4f7ee61171d2b61014551b28f
• SHA-1: 4c9c9b3309dde34022388d28a77ac7c7d6240fbd
• MD5: 9859774f74065d85c2c44ad694824d95
• ssdeep: 1536:SfWYV8Y8KXmN1cQicQy/AlEzdUPKJcHfIRqhnDdY5lllVU0:EWg38FFis4sdUPOc/IRqVduR
• TLSH: T1E738CFF711C7DD8C7746AF536ABB24A954CEC198A13287A044D8B72CC4B82EE3E10D51
• Submitted as: 1a8813c983e7.pdf
• File type: pdf · Size: 77270 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!9859774F7406
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://leonvi.ru/wb?keyword=how%20to%20change%20skin%20in%20minecraft%20cracked%201.15.2, https://uploads.strikinglycdn.com/files/05334d8c-31f0-418b-ad5d-705807cf836a/english_lesson_speaking_activities.pdf, http://garirixis.22web.org/41092749019.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://leonvi.ru/wb?keyword=how%20to%20change%20skin%20in%20minecraft%20cracked%201.15.2
• https://uploads.strikinglycdn.com/files/05334d8c-31f0-418b-ad5d-705807cf836a/english_lesson_speaking_activities.pdf
• http://garirixis.22web.org/41092749019.pdf
• http://ditumen.22web.org/bararewoxonezefudosexixip.pdf
• https://uploads.strikinglycdn.com/files/66be6191-f414-4963-982a-29c7b574dd68/historia_natural_del_dengue.pdf
• http://metalllift.ru/the_pit_and_the_pendulum_reading_guide_answerslpgrb.pdf
• https://uploads.strikinglycdn.com/files/b530a6cf-ebf8-4678-a7ed-0dbe9bed8f71/41401152793.pdf
• http://tokio-2020.fun/wosomop93f81.pdf
• http://biwijenanun.22web.org/fopevu.pdf
• https://bogekivusuwi.weebly.com/uploads/1/3/4/6/134604255/9725236.pdf
• https://uploads.strikinglycdn.com/files/ddf7fc19-af23-4cf9-90ce-069ed70b4fbd/nigerajenopunimanis.pdf
• https://static.s123-cdn-static.com/uploads/4388406/normal_5ff5c3ca072a0.pdf
• https://pejoguroboxifuj.weebly.com/uploads/1/3/1/6/131637830/9146713.pdf
• https://suterigegopos.weebly.com/uploads/1/3/2/6/132695321/padup.pdf
• https://uploads.strikinglycdn.com/files/53897ace-3773-4faa-8c3f-933da7eed653/how_to_switch_on_jaybird_x2.pdf
• http://fastcreditreport.info/3917758949aj9eb.pdf
• http://eurostore.info/8190304217645e3i.pdf
• https://uploads.strikinglycdn.com/files/6bd60f98-a665-41c9-a5b4-a8d539cc52f0/navy_seal_salary_reddit.pdf
• https://cdn-cms.f-static.net/uploads/4426828/normal_601b6a39a43a1.pdf
• https://xijoxipuxob.weebly.com/uploads/1/3/4/7/134704834/bogebope_zajekuvogu_konifelusa_pezem.pdf
• http://gusudula.iblogger.org/escala_alvarado_apendicitis.pdf
• https://cdn-cms.f-static.net/uploads/4368243/normal_601de2dd94a76.pdf
• https://static.s123-cdn-static.com/uploads/4480749/normal_5feb36b51764f.pdf
• https://uploads.strikinglycdn.com/files/d5dc7771-f82a-4b05-8605-239b095b0980/40626473437.pdf
• http://gogamezotuzapop.epizy.com/vitikavimukipitujubej.pdf

Embedded domains

• leonvi.ru
• uploads.strikinglycdn.com
• garirixis.22web.org
• ditumen.22web.org
• metalllift.ru
• tokio-2020.fun
• biwijenanun.22web.org
• bogekivusuwi.weebly.com
• static.s123-cdn-static.com
• pejoguroboxifuj.weebly.com
• suterigegopos.weebly.com
• fastcreditreport.info
• eurostore.info
• cdn-cms.f-static.net
• xijoxipuxob.weebly.com
• gusudula.iblogger.org
• gogamezotuzapop.epizy.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report