MALICIOUS — 48828349468.pdf

MALICIOUS — 48828349468.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 4bde93cdafd818614cb2013c27c9b95932ffe98619b040944796c9f29446acd2
• SHA-1: d62d0d97468c5bc3cec2d6cc64e8064f754100d2
• MD5: c365dda80cf26ceedc73ebd0c2b227b3
• ssdeep: 1536:I1SnuEPP6VmgA+F+oIf1ZXLtO+JE4wrkAX9MOiv886Bc8+0UW23YGd51:znuEPPsr0xM+JE4woAviv88EbeRYGl
• TLSH: T1BA36C0F3200BCD4D6A8FB74345F6452D784BC6892123D6A45448FAACD8BCBFE6E51091
• Submitted as: 48828349468.pdf
• File type: pdf · Size: 69540 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!C365DDA80CF2
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://irlanc.ru/uplcv?utm_term=aetna+international+claim+forms, https://yournew.site/wp-content/plugins/super-forms/uploads/php/files/qr6lnb25ntmi16c1v5q3h17nos/46253563433.pdf, https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f7e46d8ba2---mekosimegutode.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://irlanc.ru/uplcv?utm_term=aetna+international+claim+forms
• https://yournew.site/wp-content/plugins/super-forms/uploads/php/files/qr6lnb25ntmi16c1v5q3h17nos/46253563433.pdf
• https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608f7e46d8ba2---mekosimegutode.pdf
• http://www.training4thefuture.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606e55165924b---duvesetuko.pdf
• https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/e004ab9b7c8d89ad669f54e8e35a44be/weziwosa.pdf
• http://kraljicabih.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608010f0c9822---6305178778.pdf
• https://calldidocta.com/wp-content/plugins/super-forms/uploads/php/files/00ed8da639c067aeae3291da83815b02/34674264115.pdf
• https://marciasmithconsulting.com/wp-content/plugins/super-forms/uploads/php/files/08704d32c2db7bf157c306e4a0052224/38489479015.pdf
• https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/16096d4b72cb74---sazedixalisadudizajin.pdf
• http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/1607135b8862cb---96983223892.pdf
• http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/30c9ulh4gntl437ra2rqnegoq6/64223099421.pdf
• https://wkd-uk.com/wp-content/plugins/super-forms/uploads/php/files/c7963665a00254fbe626756562404126/zelinoleneravem.pdf
• http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606d561932ba4---99729216122.pdf
• http://protech.com.ng/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbfbd68cad---37729939126.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• irlanc.ru
• yournew.site
• fietenhaardenenkachels.nl
• www.training4thefuture.co.uk
• atx-stroy.ru
• kraljicabih.com
• calldidocta.com
• marciasmithconsulting.com
• frennphotography.com
• themultifold.com
• wkd-uk.com
• moveisgarciadigital.com.br
• www.w3.org
• purl.org
• ns.adobe.com
• www.farparts.cl
• protech.com.ng

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report