MALICIOUS — 1609f6f0cf1b07---30098762422.pdf

MALICIOUS — 1609f6f0cf1b07---30098762422.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 3bfc0eb2b8e12d1cdad42dc948774ee54060280c777142c3aa38a6dc0db755a4
• SHA-1: 2508854a8ef10a6940da667efbd8926483490e04
• MD5: 15c91b46ef318d68e4cb0e4cbb771af3
• ssdeep: 1536:tTsrq/9fmFjOwKo6hczwkJguIs/h6ofTVLq3ik8PnvZ:Rsrq/YFjOTH6J6uXTVLq8Px
• TLSH: T1A638E0731193DE8C76866B036973111D3486C789A136A7E4589CB7BDC8BC6FE3E01A42
• Submitted as: 1609f6f0cf1b07---30098762422.pdf
• File type: pdf · Size: 78728 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!15C91B46EF31
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://angelsstaff.com/uploads/file/50140117969.pdf, https://whitesal.com/data/images/file/9280_20210515153031.pdf, https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/371f7d40a89b2c39c85846e5ea8b17f3/68423746179.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=m.+a+political+science+syllabus+2018+pdf
• https://angelsstaff.com/uploads/file/50140117969.pdf
• https://whitesal.com/data/images/file/9280_20210515153031.pdf
• https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/371f7d40a89b2c39c85846e5ea8b17f3/68423746179.pdf
• http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/9lm90qtoioevdl0bjg23dev385/37593424670.pdf
• http://bazatalty.pl/wp-content/plugins/super-forms/uploads/php/files/d6b4ff38a37169926b6319055cf302a7/46675287533.pdf
• https://kes-stv.ru/wp-content/plugins/super-forms/uploads/php/files/756e57a80fba85d9a90213a8d7f49594/80969486565.pdf
• https://zweiund40.com/wp-content/plugins/super-forms/uploads/php/files/q6ct9hj17blamt8u4qrc3j8c3q/semadadupipudexelirug.pdf
• http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/4374b61dbb2682ed6bd64fb430cbdd99/najigelano.pdf
• https://www.teppiche-waschen-hamburg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606f95b949dd9---reluwopiboxogowel.pdf
• https://www.movingwithmagna.com/wp-content/plugins/super-forms/uploads/php/files/d8dceb99f94462443e89f5cb3db8aff6/tirexujewegovudefes.pdf
• http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/dusu10og0bd8iadou5hgr6e953/fekuribobokevuliguw.pdf
• https://q-web.ro/wp-content/plugins/super-forms/uploads/php/files/dk93t7m443tahtp45tc3iofltm/maraxugoxanab.pdf
• https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160873bfc474f7---furevososedaveno.pdf
• https://www.sodigital.it/wp-content/plugins/formcraft/file-upload/server/content/files/160987b736c07b---67763447303.pdf
• http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/hnkm6cjh8jgqgsbshpml00drnr/13228901360.pdf
• https://samiznojmo.cz/wp-content/plugins/super-forms/uploads/php/files/e27ce7e4323cef01f217ec5b44e34216/polarax.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• angelsstaff.com
• whitesal.com
• 3dreamstudios.com
• www.sunarsurdurulebilir.com
• bazatalty.pl
• kes-stv.ru
• zweiund40.com
• www.northeastmarquees.com
• www.teppiche-waschen-hamburg.de
• www.movingwithmagna.com
• www.x454.com
• www.pferde-fuer-unsere-kinder.de
• www.sodigital.it
• www.tif.cn
• www.w3.org
• purl.org
• ns.adobe.com
• q-web.ro
• samiznojmo.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report