MALICIOUS — 448c68478fb844ecda96ab5b4757cdfff5e241f4fc8049ce8bf9e12c51e1053e

MALICIOUS — 448c68478fb844ecda96ab5b4757cdfff5e241f4fc8049ce8bf9e12c51e1053e is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 448c68478fb844ecda96ab5b4757cdfff5e241f4fc8049ce8bf9e12c51e1053e
• SHA-1: 1d65c051e33e0d1fc24d6850c5289648d3c92aaa
• MD5: 9b4989b44d6288da9eadb2e62732f9e6
• ssdeep: 1536:/A2JxMRf6mHAqkJaF67g58Ae2wr91tPC/aTNg1tCQRiyPIeIZWzWApO6eWlsLgT1:bY3+75a4YaTNg1tChoCWC6fswspA
• TLSH: T11B38CFF32097DD4C77ABAB1325EB1158B08AEA882162F690418C7B7CD57C5BE7F00A51
• Submitted as: 448c68478fb844ecda96ab5b4757cdfff5e241f4fc8049ce8bf9e12c51e1053e
• File type: pdf · Size: 83410 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/160be7c94d9ee3---pelalavuzapuvutawinapide.pdf, https://www.kiteschule-eckernfoerde.de/wp-content/plugins/formcraft/file-upload/server/content/files/160890047647b8---88684224726.pdf, https://www.eecpowerindia.com/codelibrary/ckeditor/ckfinder/userfiles/files/setakebadoba.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=how+much+is+30+cc+in+ounces
• http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/160be7c94d9ee3---pelalavuzapuvutawinapide.pdf
• https://www.kiteschule-eckernfoerde.de/wp-content/plugins/formcraft/file-upload/server/content/files/160890047647b8---88684224726.pdf
• https://www.eecpowerindia.com/codelibrary/ckeditor/ckfinder/userfiles/files/setakebadoba.pdf
• http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e70465a39fb---85980937980.pdf
• http://asavn.vn/uploads/userfiles/files/99640862020.pdf
• http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16076d565dbe1f---lufotejifivajepazisepiru.pdf
• https://zohopin.com/calisma2/files/uploads/rarulanebiduneroxanaduba.pdf
• http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/160794b8aaa24c---luramenomurogunu.pdf
• https://argekaucuk.com/nbg/upload/files/kevejalebibiviminufow.pdf
• https://bauarch.bg/files/zijugese.pdf
• http://saveondealz.com/ckeditor/ckfinder/core/connector/php/uploads/files/80248408605.pdf
• http://domeinbeverdonk.be/assets/files/file/28311666930.pdf
• http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607279a58de7c---71574434452.pdf
• https://chp-travel.ir/data/file/24501336886.pdf
• https://www.msolartop.cz/wp-content/plugins/formcraft/file-upload/server/content/files/16076cfc781bbe---60431097088.pdf
• https://makemycake.gr/wp-content/plugins/super-forms/uploads/php/files/mh8mj800oem39r0lsom48poh6m/tepodalirofiduvazujisuto.pdf
• http://aceonlinementors.com/userfiles/file/83373336866.pdf
• https://questyme.ca/userfiles/file/28084405259.pdf
• https://nikosdimos.gr/userfiles/file/71855155234.pdf
• http://www.impactit.in/ckfinder/userfiles/files/60585454395.pdf
• http://tjsijiqing.com/ckfinder/userfiles/files/2021/0823/81f5486e89a44454e18f171634c82bfb.pdf
• https://mystruggle.uk/indigo/ckfinder/userfiles/files/86929032506.pdf
• https://parisautotravel.com/wp-content/plugins/super-forms/uploads/php/files/oqj2h8m01ukjq71gllqlm6jvu7/3424100628.pdf
• http://prime-standard.com/piceditor/file/pevotekapizulinab.pdf

Embedded domains

• feedproxy.google.com
• triumphtoday.org
• www.kiteschule-eckernfoerde.de
• www.eecpowerindia.com
• www.gametimecatering.com
• zohopin.com
• argekaucuk.com
• saveondealz.com
• domeinbeverdonk.be
• dmn.ca
• chp-travel.ir
• aceonlinementors.com
• questyme.ca
• www.impactit.in
• tjsijiqing.com
• mystruggle.uk
• parisautotravel.com
• prime-standard.com
• www.w3.org
• purl.org
• ns.adobe.com
• asavn.vn
• www.ddd-iasi.ro
• bauarch.bg
• www.msolartop.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report