MALICIOUS — 5b2b2028cfdf478f3b117eec9eb4eca5e0b665c48f6ca6008e762f87bbed47f3

MALICIOUS — 5b2b2028cfdf478f3b117eec9eb4eca5e0b665c48f6ca6008e762f87bbed47f3 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 5b2b2028cfdf478f3b117eec9eb4eca5e0b665c48f6ca6008e762f87bbed47f3
• SHA-1: cc48e43412604f5755671f77d88fe6fa2d148c33
• MD5: b6bfbf74f7c01e8718101ebe335fe2b5
• ssdeep: 1536:0lcxoZYAHxnzoAjdsYWj+buz/9kB5LQa6LxRFzT5Tc40XQZ83FPe1z:RqYARnzoKsHjMmiBxkRTcZm81Pc
• TLSH: T17138CFF3515BDD0CAF4B97C3ADA7266D219BE2C82176D3A40494A76CC4AC27C3F11A60
• Submitted as: 5b2b2028cfdf478f3b117eec9eb4eca5e0b665c48f6ca6008e762f87bbed47f3
• File type: pdf · Size: 76959 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!B6BFBF74F7C0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://archism.ru/uplcv?utm_term=magic+leap+lightwear, http://www.holderit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab5f32d84e9---kovavibetopewidivuj.pdf, https://artasedanasingaraja.com/uploadfck/file/sidoxeladafojuvu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://archism.ru/uplcv?utm_term=magic+leap+lightwear
• http://www.holderit.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab5f32d84e9---kovavibetopewidivuj.pdf
• https://artasedanasingaraja.com/uploadfck/file/sidoxeladafojuvu.pdf
• http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbb8a653b8---dobozor.pdf
• http://blessingsngo.in/userfiles/files/pilasefatirunazokogi.pdf
• https://www.propertyfilevault.com/wp-content/plugins/super-forms/uploads/php/files/c3555ccacbd97eeb336f94a5cf2804c3/lixutazasipatikoxavo.pdf
• https://monacollection.ua/wp-content/plugins/super-forms/uploads/php/files/7f6dd17244bf8eaa5c0b86a41a4cdf2c/98042454934.pdf
• http://canevinclassof70.com/clients/6/6b/6b8b8ee0d314e59372afbcb75100d768/File/59193684712.pdf
• http://lbs.ac.at/wp-content/plugins/super-forms/uploads/php/files/4gg8ihjre0c6oonsdesn64fr03/41894341800.pdf
• http://www.mkkdigital.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1608e40d6ed9ce---raseli.pdf
• https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/498b312c523114a0e07c9ae24ac21972/66287034540.pdf
• http://imagespa.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1608267d2c2400---53775597188.pdf
• https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/9hnnosumu39sj22c8bnghr8h0g/91995377312.pdf
• http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b78b6675196---kitivax.pdf
• https://relleno-acidohialuronico.com/wp-content/plugins/super-forms/uploads/php/files/075f10e834a73c3a2a1bf33cb3e3d5de/97395363664.pdf
• http://infinity-pro.ru/userfiles/file/mujalujulomuke.pdf
• https://urbanplace.me/wp-content/plugins/super-forms/uploads/php/files/b8a3de5021ae1079d2ac636d2dd54496/fejunuge.pdf
• http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/1608c7fa38c773---risuluvuzafojureto.pdf
• https://aawyx.com/sites/default/imageuser/file/22009404441.pdf
• http://aweibel.com/Photo/file/39891337327.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• archism.ru
• www.holderit.com
• artasedanasingaraja.com
• inspirationallabels.co.uk
• blessingsngo.in
• www.propertyfilevault.com
• monacollection.ua
• canevinclassof70.com
• www.straightmyteeth.eu
• imagespa.mx
• heritagelogs.com
• luckyassessoria.com.br
• relleno-acidohialuronico.com
• infinity-pro.ru
• urbanplace.me
• www.appsolutely.sg
• aawyx.com
• aweibel.com
• www.w3.org
• purl.org
• ns.adobe.com
• lbs.ac.at
• www.mkkdigital.pt

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report