MALICIOUS — 975017222.pdf

MALICIOUS — 975017222.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 57b180b0b2ccbdb87ed699658efa23fbdb87eddebfccdf4fefc198a4497c2981
• SHA-1: 7162dad04f7aec02717e6bd96ce7834db95229cf
• MD5: d264df0f56611980f30695864e0d6f7c
• ssdeep: 1536:MvTqH6UWsSDyqI+v/siW8AOlUN86YX74+59SX:XHksSDoiW8AOuy7i
• TLSH: T16D36CFE36193DD48BB9B6F472ED224686446D28871239B34948C7B7DD1BC3BDBD10A20
• Submitted as: 975017222.pdf
• File type: pdf · Size: 67678 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!D264DF0F5661
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://lordoptika.hu/files/files/sizuruwobefosuroxobunud.pdf, https://lightspec.ca/wp-content/plugins/super-forms/uploads/php/files/a43df82537a72afdce6bf3dcc6cf34e9/xagoxavofesodapemu.pdf, https://westcoastmovers.ca/wp-content/plugins/super-forms/uploads/php/files/2rfnjnrc13c3h39anpvt7kq03l/wetozolisuz.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=veera+hd+video+songs+download
• https://lordoptika.hu/files/files/sizuruwobefosuroxobunud.pdf
• https://lightspec.ca/wp-content/plugins/super-forms/uploads/php/files/a43df82537a72afdce6bf3dcc6cf34e9/xagoxavofesodapemu.pdf
• https://westcoastmovers.ca/wp-content/plugins/super-forms/uploads/php/files/2rfnjnrc13c3h39anpvt7kq03l/wetozolisuz.pdf
• https://cristiandellavedova.com/wp-content/plugins/super-forms/uploads/php/files/87rckufnjjj03gb87cflauh426/87144408025.pdf
• http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a6c0600e738---mowofawovunozetopesoxaf.pdf
• https://csom.cz/wp-content/plugins/super-forms/uploads/php/files/8530036483c4c92570261e79dc49139d/16054544959.pdf
• http://qkmedica.com/uploads/userfiles/file/99122666672.pdf
• https://aduanaldelvalle.com/userfiles/file/8239979977.pdf
• https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/n55u2brimuatabte0njgeivi4n/pofepugefixane.pdf
• http://foto-klub.dk/userfiles/file/duzopekikolipu.pdf
• https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/ae88b883284a2160f8733e4a17ece5b3/wolizon.pdf
• http://mirrorgallery.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9b47c8f81c---jotojitirukewuw.pdf
• http://sacoorhealth.pt/site/upload/file/dotejewizoverufazarukode.pdf
• https://rhythmcprandfirstaid.com/wp-content/plugins/super-forms/uploads/php/files/8b988da5d6e451c84def976f58ec33ce/22704981066.pdf
• https://ontime-taxi.kg/wp-content/plugins/super-forms/uploads/php/files/53966a12106c6e61e6a744c49056557e/gekuvikexuresuti.pdf
• https://formapolis.it/wp-content/plugins/super-forms/uploads/php/files/a2fcb711ec8f408faf060f507426ef07/pafixumufar.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• lightspec.ca
• westcoastmovers.ca
• cristiandellavedova.com
• zadonskiy.ru
• qkmedica.com
• aduanaldelvalle.com
• www.adelaarenergy.com
• amirep.com
• mirrorgallery.com
• rhythmcprandfirstaid.com
• formapolis.it
• www.w3.org
• purl.org
• ns.adobe.com
• lordoptika.hu
• csom.cz
• foto-klub.dk
• sacoorhealth.pt
• ontime-taxi.kg

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report