MALICIOUS — 98771408485.pdf

MALICIOUS — 98771408485.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 53426fdd12f8f93a98cef03b519b06f9235126aa4736e034c5e1abf560c21346
• SHA-1: bf16babe94c74e8dc48e203123044e8f7f5fb691
• MD5: f9161e677c81dbd69da9dc69e01c2e9a
• ssdeep: 1536:xu/cY0YFsI0+QLTN4HB/3o9VTGGjACqrE+HZWbpONiWljNwgrcP7W:RKsI/q4HB/qVyG8e+HbNrjugrl
• TLSH: T19137CFF3619BDE8C7B479F4369E62158649FD78C2112AED44088776CD0ECA7DBE00A90
• Submitted as: 98771408485.pdf
• File type: pdf · Size: 71111 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607786bd81fd2---23265511704.pdf, https://www.die-umzugsfabrik.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d75781822ce---29858831186.pdf, https://uclerbaklava.com/resources/file/13000513517.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=membrane+structure+and+function+worksheet+answer
• http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607786bd81fd2---23265511704.pdf
• https://www.die-umzugsfabrik.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d75781822ce---29858831186.pdf
• https://uclerbaklava.com/resources/file/13000513517.pdf
• http://tevukasveza.lt/ckfinder/userfiles/files/musoradoju.pdf
• https://khambenhxahoi115.com/images/files/54104266821.pdf
• https://bbensonmft.com/wp-content/plugins/super-forms/uploads/php/files/2648c92ebacd6c708b58b181e6467399/71894126603.pdf
• http://ohxto.com/uploaded_files/userfiles/files/3342904350.pdf
• http://orgue-chantepie.info/FCKeditor/upload/file/zexegolumikire.pdf
• https://hopadive.cz/ckfinder/userfiles/files/23974565725.pdf
• https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/e88e0ed724afa7270cffb68805a92a8d/90402209175.pdf
• http://faxik.ru/ckfinder/userfiles/files/zikuvelere.pdf
• https://novinfasteners.com/userfiles/file/julirufixinexas.pdf
• https://andhimazhai.com/images/files/rosuxinebisex.pdf
• http://alrehabourhome.com/userfiles/files/53682146099.pdf
• https://www.taxikladis.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1609c5866ce63f---44520392984.pdf
• https://inchiriereelicopterromania.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b801bef01d6---zogif.pdf
• https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a5842d13df7---86971937734.pdf
• http://c2mag.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa8aa74afe9---78118385529.pdf
• http://eska-lift.ru/userfiles/file/xivanen.pdf
• https://madeinstlucia.com/userfiles/files/37921918024.pdf
• https://299-45.com/CKEdit/upload/files/1863044539.pdf
• https://bjjewels.net/nbloom/fckuploads/file/54736410789.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• feedproxy.google.com
• totaleclipsenv.com
• www.die-umzugsfabrik.com
• uclerbaklava.com
• khambenhxahoi115.com
• bbensonmft.com
• ohxto.com
• orgue-chantepie.info
• amezdigital.com
• faxik.ru
• novinfasteners.com
• andhimazhai.com
• alrehabourhome.com
• www.physioaktivkramer.de
• c2mag.com
• eska-lift.ru
• madeinstlucia.com
• 299-45.com
• bjjewels.net
• www.w3.org
• purl.org
• ns.adobe.com
• tevukasveza.lt
• hopadive.cz
• www.taxikladis.gr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report