MALICIOUS — 66348077097.pdf

MALICIOUS — 66348077097.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 4c1e5976dc5e79dc380897a296cd5e5ce8e9e5b4afbfb896e18e03fa12ceeb86
• SHA-1: e07a82792506297ca0951535693ef94e5f73d936
• MD5: 634218d3a7d8de779089832ea50b3deb
• ssdeep: 1536:xgm0lkVnjqNbZfHThflb3KmAH5iMItWXzq0hQWLWQpOCoWFPbVzUu4va:L6kRqlZfTh9b3Kma5WtXW2ChVZN
• TLSH: T10139C0F321A7ED9C73875B4319AA1539F88EDB846162DB5041C8B67CC5BC6BDBE00A10
• Submitted as: 66348077097.pdf
• File type: pdf · Size: 84359 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://womensmentalhealthmd.com/clients/9/9a/9a9ccad1be43d50cbc9928f06550b956/File/17475287028.pdf, http://aarogyamedico.com/userfiles/file/59376546034.pdf, http://videoacceso.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607de4e2a9ba1---58469676625.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/1KS0DP0cxss/uplcv?utm_term=sofar+solar+inverter+user+manual
• http://womensmentalhealthmd.com/clients/9/9a/9a9ccad1be43d50cbc9928f06550b956/File/17475287028.pdf
• http://aarogyamedico.com/userfiles/file/59376546034.pdf
• http://videoacceso.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607de4e2a9ba1---58469676625.pdf
• https://clumba-indoor.ru/files/files/jutibukonej.pdf
• http://a-kamen.com/userfiles/file/85670393251.pdf
• http://allmedicus.com/userfiles/file/nifolateviradibujon.pdf
• http://eventologia.com/userfiles/files/zexowuzamuwijewapure.pdf
• http://anhuicrew.com/upload_fck/file/2021-5-13/20210513224258957186.pdf
• https://amthanhanhsangchinhhang.vn/upload/files/gowiremovisifaziwovi.pdf
• http://startmatbaa.com/userfiles/file/filuruzutuvo.pdf
• http://travelbilet.ru/sites/default/files/file/71287805868.pdf
• https://agatanorek.com/files/file/17672740463.pdf
• https://www.hintonassociates.com/wp-content/plugins/super-forms/uploads/php/files/1b0096baa2468d71e0eb84a76dde64df/84537580983.pdf
• https://jamuiboe.com/webroot/upload_media/24958966526.pdf
• http://www.kocay.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc4c551e21---70481925109.pdf
• http://uleshuzatshop.hu/files/file/puwawukaji.pdf
• http://janjoling.com/public/ckfinder/userfiles/files/kenuwomejekaza.pdf
• https://classconnbio.com/img-jacson/files/34861643823.pdf
• http://duda-tech.pl/dudatech/upload/file/3293978314.pdf
• https://www.kasekimi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607dd18a666f2---sukase.pdf
• http://lmalaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/neveviditobidomupiga.pdf
• http://kubablimel.pl/Image/files/29654758851.pdf
• https://clubforeducation.com/FCKeditor/userfiles/file/59121145659.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• feedproxy.google.com
• womensmentalhealthmd.com
• aarogyamedico.com
• videoacceso.com
• clumba-indoor.ru
• a-kamen.com
• allmedicus.com
• eventologia.com
• anhuicrew.com
• startmatbaa.com
• travelbilet.ru
• agatanorek.com
• www.hintonassociates.com
• jamuiboe.com
• janjoling.com
• classconnbio.com
• duda-tech.pl
• www.kasekimi.com
• lmalaw.com
• kubablimel.pl
• clubforeducation.com
• www.w3.org
• purl.org
• ns.adobe.com
• amthanhanhsangchinhhang.vn

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report