MALICIOUS — 16126317001.pdf

MALICIOUS — 16126317001.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

SHA-256: 3cdfce37059716370f4694d4e92742dbde1c338bd91cf70e318938a5194709e5
SHA-1: 6efed71c50f547a4c905379e061efea14ed779fe
MD5: e051cfc65a984e54d08e79fd17f0f1d2
ssdeep: 3072:0Evid4aUTeRN9QuX2qxKHEfrYZaCOXd8nlJitPuagg7vQi/dY:0ZmaUyR8uGpkjYoCSd8ni3ggzm
TLSH: T1033DF1B321ABDD8C7947DB435AF92178A44BC6C870B2DAA440887A3CC4BC5FDAF21551
Submitted as: 16126317001.pdf
File type: pdf · Size: 131237 bytes
Verdict: malicious (92/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: http://x04ydivan.ru/userfiles/file/97207897294.pdf, https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/c6qbftqu7obnb1crem46oh96t6/lasuriwowadu.pdf, https://cgeminfos.ma/upload/file/88924577735.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=pokemon+dark+rising+2+legendaries
http://x04ydivan.ru/userfiles/file/97207897294.pdf
https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/c6qbftqu7obnb1crem46oh96t6/lasuriwowadu.pdf
https://cgeminfos.ma/upload/file/88924577735.pdf
http://www.supercarrentalsofmiami.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c8e9476b11---pujudes.pdf
http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160c8ab4467af7---73652826339.pdf
http://www.catalogodecineargentino.com/wp-content/plugins/formcraft/file-upload/server/content/files/160735221b1d74---dapoxelasifati.pdf
http://gancza.pl/userfiles/file/87938643413.pdf
http://orrizon.ru/images/file/nuwoninevamixelivojo.pdf
https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080a89e838a7---kopobimunepotibolowu.pdf
https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608a113780b88---budivukemibusuzar.pdf
http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf1fa8a3827---tosabewivi.pdf
http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160befb2f14285---sijad.pdf
https://havanic.com/cache/fck_files/file/75499840167.pdf
http://zkojicin.cz/userfiles/file/21092140246.pdf
https://www.themeshcowork.com/wp-content/plugins/super-forms/uploads/php/files/a23a1b3d4d99757f2cff6988cbe4275a/58447197363.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

feedproxy.google.com
x04ydivan.ru
mziagroup.com
www.supercarrentalsofmiami.com
zadonskiy.ru
www.catalogodecineargentino.com
gancza.pl
orrizon.ru
www.ediliziaindustriale.com
klingende-zeder.de
www.infranetltd.com
www.ausafrica.co.za
havanic.com
www.themeshcowork.com
www.w3.org
purl.org
ns.adobe.com
cgeminfos.ma
zkojicin.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report