MALICIOUS — 19907658835.pdf

MALICIOUS — 19907658835.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 4a24eadef5fc61f822a15cc5dcae7c3885c9aa910809917262d532f007fcb492
• SHA-1: 80e7f05ada992fd9565c93a78aa1de88953d0ccd
• MD5: 5a56f0c9cb206b9d7ef03fc7c7cb5cea
• ssdeep: 1536:R+gUsIIbTh5txSlVqqeAUFHNNsPWiTiidclcmJU75WDROTlATx+jzrZoWUpO7jma:0MbvSlVm7RNNCpiiGCqsj/ZL7S2T
• TLSH: T16038C1F310ABED9CBA5BAF0369B6015C6586E7841072DB60404CF65C897C6FEBF24A11
• Submitted as: 19907658835.pdf
• File type: pdf · Size: 84241 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=margaritaville+blender+dm1000+manual, http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f48dac79b6---bapekitafotefusetofawe.pdf, https://cicadit.ro/UserFiles/file/17768323580.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://garglob.ru/uplcv?utm_term=margaritaville+blender+dm1000+manual
• http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f48dac79b6---bapekitafotefusetofawe.pdf
• https://cicadit.ro/UserFiles/file/17768323580.pdf
• http://bethanybaptistcolumbus.org/clients/75549/File/87817496533.pdf
• http://herfon-machinery.com/images/ckfinder/files/20210713041420.pdf
• https://popcouncilinstitute.org/wp-content/plugins/super-forms/uploads/php/files/b17df50bbd012a4b4d2eba3113279a7c/maritumowejiba.pdf
• http://www.virtualaid.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160c8d064dbc29---74630935762.pdf
• http://knuhpharm.kr/userfiles/file/20210714050353.pdf
• https://www.generalutilities.com/wp-content/plugins/formcraft/file-upload/server/content/files/161358f1240f9d---23598523628.pdf
• http://mhfmjournal.com/data/22/2/55/64/2544879/user/2788947/htdocs/userfiles/file/rajuserofi.pdf
• http://sensi-leszno.pl/userfiles/file/77973778606.pdf
• http://romento.com/uploaded_files/userfiles/files/meveliwefiweziwoxi.pdf
• http://msmzizkov.cz/data/dokumenty/87332138083.pdf
• http://ecovn.vn/uploads/news_file/reravotixewumuvo.pdf
• https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/160a4bd870c7ab---35555204727.pdf
• https://bursakaynak.com/userfiles/file/lovosowow.pdf
• https://stpeterscbs.ca/ckfinder/userfiles/files/wirugetokuzi.pdf
• http://cualuoiskydoor.com/webroot/img/files/15997016782.pdf
• http://www.cavice.fi/tiedostot/files/90648650309.pdf
• http://www.qookspot.kitchen/wp-content/plugins/formcraft/file-upload/server/content/files/1607af13e3989b---60919888118.pdf
• https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a463ef19247---77589211921.pdf
• http://abapaposentados.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a868267865b---wegipekotawimofewa.pdf
• https://jetaime-shop.com/files/12722657293.pdf
• https://sanaspinler.com/calisma2/files/uploads/64697812982.pdf
• https://refundsrefunds.com/wp-content/plugins/formcraft/file-upload/server/content/files/160909cebf2062---simidurubuxiwopuveva.pdf

Embedded domains

• garglob.ru
• yuseigachi.nl
• bethanybaptistcolumbus.org
• herfon-machinery.com
• popcouncilinstitute.org
• www.virtualaid.eu
• knuhpharm.kr
• www.generalutilities.com
• mhfmjournal.com
• sensi-leszno.pl
• romento.com
• bursakaynak.com
• stpeterscbs.ca
• cualuoiskydoor.com
• www.cavice.fi
• www.euroservicemilano.it
• abapaposentados.com.br
• jetaime-shop.com
• sanaspinler.com
• refundsrefunds.com
• sarahscupcakery.com
• www.w3.org
• purl.org
• ns.adobe.com
• cicadit.ro

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report