MALICIOUS — 31440915067.pdf
MALICIOUS — 31440915067.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
50f223512f862be343c51e81af200c827906fc0a70bcb2b06f04dd6f1a2f03a9 - SHA-1:
1cbfdf764ec810d05d3d58d2b85352e4814134ed - MD5:
39d02376aeb03895ab2f053ea55b5628 - ssdeep:
1536:20c4D1fDGy9tG0+DDomfno9C7v8Ca4Zt+8bo4kRPWRsUJ6o6lOWxApOG9kED+EDD:zcgfDGyW7Dm98v8Causlb3G9HD+O5j - TLSH:
T17D3AE1F330A7CD5C7A9F9F03A9EA915DA489D7881222DE50448CF57C84BC7BD7A10641 - Submitted as: 31440915067.pdf
- File type: pdf · Size: 97216 bytes
- Verdict: malicious (92/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://ketchas.ru/uplcv?utm_term=earn+to+die+flash+game, http://usefchina.com/uploadfile/file///2021090913325363.pdf, https://msiutilities.net/documents/24818865054.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ketchas.ru/uplcv?utm_term=earn+to+die+flash+game
- http://usefchina.com/uploadfile/file///2021090913325363.pdf
- https://msiutilities.net/documents/24818865054.pdf
- http://www.a-fairys-choice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16130a8333d550---89605498219.pdf
- http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132533fa2509---lirinizeg.pdf
- http://educasters.co/ckfinder/userfiles/files/giwuvulabagosa.pdf
- http://geonatlife.es/ckfinder/userfiles/files/53905277527.pdf
- http://saipanbooking.com/FileData/ckfinder/files/20210902_12927DC9055A4894.pdf
- http://mexvp.com/ckfinder/userfiles/files/31737934448.pdf
- https://perfecthospitals.org/ckfinder/userfiles/files/nusotaru.pdf
- https://cmfnepal.org/userfiles/files/16199244258.pdf
- https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/ojiqu2nh93naieg96h5ugfai97/tidikig.pdf
- http://bugaboo-buffalo.eu/UserFiles/File/wowem.pdf
- http://gr-chem.com/upload/files/wuwadaxovab.pdf
- http://tehnicgaz.eu/files/file/9573187170.pdf
- https://h16hr15k-h19hr37urn.com/contents/files/fumagogumupe.pdf
- https://bomnuocebara.com/quangbasanpham/app/webroot/upload/image/files/21503790488.pdf
- http://solamsys.com/userData/board/file/36217048779.pdf
- http://www.performhabitat.fr/bundles/astadmin/js/ckfinder/userfiles/files/seremenowasetazaduf.pdf
- http://managhantasala.net/mailuserfiles/file/suxinitumijunosetado.pdf
- http://onnetsolution.in/userfiles/file/najawenutup.pdf
- http://holmeslawfirm-iowa.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/28052728554.pdf
- https://kindliving.org/wp-content/plugins/super-forms/uploads/php/files/tmp/91485802725.pdf
- http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1613060bc8fc38---37167318292.pdf
- http://bensonlandscape.com/editorData/file/taridolagigituletuku.pdf
Embedded domains
- ketchas.ru
- usefchina.com
- msiutilities.net
- www.a-fairys-choice.com
- www.191seo.com
- educasters.co
- geonatlife.es
- saipanbooking.com
- mexvp.com
- perfecthospitals.org
- cmfnepal.org
- bugaboo-buffalo.eu
- gr-chem.com
- tehnicgaz.eu
- h16hr15k-h19hr37urn.com
- bomnuocebara.com
- solamsys.com
- www.performhabitat.fr
- managhantasala.net
- onnetsolution.in
- holmeslawfirm-iowa.com
- kindliving.org
- www.kinoimaging.nl
- bensonlandscape.com
- upsshop.ru
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report