MALICIOUS — 73801290621.pdf

MALICIOUS — 73801290621.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 3745efdd43b896c27d3ef1f470b1d306f2b57153059743790d2bca3098a0f82a
• SHA-1: 6a3841e655aba4b7b996c10ce6a27b622b916236
• MD5: a77e883eb96511d24d1419b2c1e75eb7
• ssdeep: 1536:HsKhM8M1/chcZlynqE2Uxq6MT5cCpY4x+Ql/2bio4MsyhrwN:MKhfMCUyq43u5px0molsyI
• TLSH: T1E837D0F33157DD4C7ADA5B036AAA70AD748EDAC88073D7900098F7ACD4AC67E6D40960
• Submitted as: 73801290621.pdf
• File type: pdf · Size: 74783 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!A77E883EB965
• Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://irlanc.ru/uplcv?utm_term=5e+dnd+character+sheet, https://anpheatingandac.com/nbloom/fckuploads/file/80682239033.pdf, http://apartmaji-zunicmile.com/uporabnik/file/17803899327.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://irlanc.ru/uplcv?utm_term=5e+dnd+character+sheet
• https://anpheatingandac.com/nbloom/fckuploads/file/80682239033.pdf
• http://apartmaji-zunicmile.com/uporabnik/file/17803899327.pdf
• https://luminex.pl/upload/file/momutunido.pdf
• http://diagonal.org.ar/wp-content/plugins/formcraft/file-upload/server/content/files/1609da7b144f55---37237001952.pdf
• http://mgocsm.in/userfiles/file/10503334522.pdf
• https://gpuhub.net/wp-content/plugins/super-forms/uploads/php/files/j62edb6eanriu0d169msiuvkgd/salufasulapiwimimuj.pdf
• https://dezsredstvompx.ru/wp-content/plugins/super-forms/uploads/php/files/da2d06ee9aa0c81a2a73cae52c877dee/nowalawonuke.pdf
• https://interesttour.com/wp-content/plugins/super-forms/uploads/php/files/499062d530be1c7fb2d35573e0ecc3d0/13711693259.pdf
• http://www.radiopopiatej.com/wp-content/plugins/formcraft/file-upload/server/content/files/160772e8d5dad1---xubinifonu.pdf
• https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608d04f117e64---27522375359.pdf
• https://sarujiovalente.com/wp-content/plugins/super-forms/uploads/php/files/imnc4bv9tp43b4rp089v8k3hi2/vokojigelezolupezujawex.pdf
• https://dbjadow.pl/attachments/file/95382773390.pdf
• https://www.web2business.pt/wp-content/plugins/formcraft/file-upload/server/content/files/160825404353a0---figulimesawetojub.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f1ddf46233---sokufozal.pdf
• http://0-50.ru/userfiles/file/88540260780.pdf
• https://m-co.de/wp-content/plugins/super-forms/uploads/php/files/qkg4g7ogbubkb92cf89kon6s9j/zejisivadofekeledafe.pdf
• http://stylist.in.ua/wp-content/plugins/formcraft/file-upload/server/content/files/1608ea639f05cf---pofovemizewo.pdf
• https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb0e628f9d---lutowomuxumiwexamusaxini.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• irlanc.ru
• anpheatingandac.com
• apartmaji-zunicmile.com
• luminex.pl
• mgocsm.in
• gpuhub.net
• dezsredstvompx.ru
• interesttour.com
• www.radiopopiatej.com
• www.euroservicemilano.it
• sarujiovalente.com
• dbjadow.pl
• www.1000ena.com
• 0-50.ru
• m-co.de
• stylist.in.ua
• www.w3.org
• purl.org
• ns.adobe.com
• diagonal.org.ar
• www.web2business.pt
• www.tai.gr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report