MALICIOUS — bolanofade.pdf

MALICIOUS — bolanofade.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 5c9c10842d02cf07f4f99239a59dfde25639809d4e7d445e71181bba351767a6
• SHA-1: 17516aa71c1574495c0a7734c7d5f9abaf7948ef
• MD5: 08e924ca6f8f42da3a9bdbcf44782b5d
• ssdeep: 1536:buVyvSsp2becNgz4N4xpW8oB29HAQAtClPNLaWrPI0UDUcqO2WpphPPWUpO7hvgS:QyvgizxW8oB1tClPXTiUcZRhPi7hPKYJ
• TLSH: T1BE3AC0B330E7DD8C778AAB0365E92558B14BD3882222FAA454C4B77CD46C67CBE10E51
• Submitted as: bolanofade.pdf
• File type: pdf · Size: 98231 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://catamma.ru/uplcv?utm_term=digital+image+processing+by+dhananjay+theckedath+pdf, https://prosegik.com/wp-content/plugins/super-forms/uploads/php/files/269fe1f141667281335fce81cb02bfd0/15851772323.pdf, https://baigiangtoanhoc.com/upload/files/parak.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://catamma.ru/uplcv?utm_term=digital+image+processing+by+dhananjay+theckedath+pdf
• https://prosegik.com/wp-content/plugins/super-forms/uploads/php/files/269fe1f141667281335fce81cb02bfd0/15851772323.pdf
• https://baigiangtoanhoc.com/upload/files/parak.pdf
• https://oknoplus-omsk.ru/wp-content/plugins/super-forms/uploads/php/files/36e8026586f57f5fab521c190a9a2d1f/83563657029.pdf
• https://areicon.com/images/file/33135894740.pdf
• https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/fu1vi31o8v4lao2eqocsrlj27r/bisugijilaseran.pdf
• http://daglichtfilters.nl/ckfinder/userfiles/files/75751088064.pdf
• http://thanhlamresort.vn/wp-content/plugins/formcraft/file-upload/server/content/files/160ae00165235a---fabamenigewezevepewovuxid.pdf
• http://innotec-industrie.be/userfiles/file/76025076038.pdf
• http://togetherwewalkny.org/clients/2/24/2411cc079aa0f0d7fd57f81c6163ecfd/File/duzolunusulezubutorek.pdf
• http://abapaposentados.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160aa59a46cecd---bumujotagamedimoja.pdf
• https://adian.eus/files/galeria/files/kanibib.pdf
• https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/160860193015fe---koforodavowulaxi.pdf
• https://www.paparazzirestaurant.com.au/wp-content/plugins/super-forms/uploads/php/files/32b05324175ef46ea0aacda94b998109/mabomitigi.pdf
• http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160702a1667116---11886962568.pdf
• https://www.kbstephens.com/wp-content/plugins/super-forms/uploads/php/files/e7ae6a266451959ef188feba5f8818ec/92519664547.pdf
• http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7db293194---27145736868.pdf
• http://pwr-tech.ru/userfiles/file/21110198545.pdf
• https://www.isnb.co.uk/wp-content/plugins/super-forms/uploads/php/files/c4e3ff196876e1906f757ae8776f7d46/runexovazule.pdf
• https://www.straightmyteeth.com/wp-content/plugins/super-forms/uploads/php/files/85c11905d6c816ee2d3f4668c2946e88/palixifufal.pdf
• https://www.xcelsus.de/wp-content/plugins/formcraft/file-upload/server/content/files/16094de8296fd4---gazazeradanawunate.pdf
• https://suksesunited.com/contents//files/gopuzokikodelowakoposed.pdf
• https://angkaganjil.com/contents//files/57794428564.pdf
• http://cargo3030.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607e975baf6dc---18125235923.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• catamma.ru
• prosegik.com
• baigiangtoanhoc.com
• oknoplus-omsk.ru
• areicon.com
• kodeac.com
• daglichtfilters.nl
• innotec-industrie.be
• togetherwewalkny.org
• abapaposentados.com.br
• www.colegiodesafio.net
• www.paparazzirestaurant.com.au
• www.kinoimaging.nl
• www.kbstephens.com
• test.uebersetzungen-nesselberger.de
• pwr-tech.ru
• www.isnb.co.uk
• www.straightmyteeth.com
• www.xcelsus.de
• suksesunited.com
• angkaganjil.com
• cargo3030.ru
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report