MALICIOUS — vabidivonamabiner.pdf

MALICIOUS — vabidivonamabiner.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 5ea76ad4b64442203870061e87a7839e67d16dd2d57196ca5eea991017760255
• SHA-1: c8f7c16826958f725135104f0b7f2beeeabfc320
• MD5: 2c74b845809321c22f6cacc1f05f5e09
• ssdeep: 1536:1LwzmXWF0rj0h/8TAJwNPy2ce4kknNY5usayqz5udDkQA:BwyAWjO/q8ivcDZ7sayqsy
• TLSH: T13E38DFF3526BED4CA6C7AB4769AA241E6447EAC07173E75880D8F65CC4782BD7F00A01
• Submitted as: vabidivonamabiner.pdf
• File type: pdf · Size: 79197 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!2C74B8458093
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://philabc.ru/uplcv?utm_term=the+invisible+man+questions+and+answers, https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/e9fc1cb5a815af9f478a78c289c49d24/14728810300.pdf, http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/16076ab4f1b80f---lupenoviwagifolevoduji.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://philabc.ru/uplcv?utm_term=the+invisible+man+questions+and+answers
• https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/e9fc1cb5a815af9f478a78c289c49d24/14728810300.pdf
• http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/16076ab4f1b80f---lupenoviwagifolevoduji.pdf
• http://www.jhannahs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bbf6217866a---93389820508.pdf
• http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c6f6e6b5986---57489741774.pdf
• https://idfusionllc.com/wp-content/plugins/super-forms/uploads/php/files/e763f68b4f5d3601783593cd9320a891/48786366075.pdf
• http://www.sunargrup.com.tr/wp-content/plugins/super-forms/uploads/php/files/pa3q811pqgha9ugm9jqolebvg6/muzisaviselikobodofurew.pdf
• http://xn--939a66v0zjo3bcvdmrp.com/data/ckfinder/files/losuwoka.pdf
• https://naseeha.org/wp-content/plugins/super-forms/uploads/php/files/b693f0de2d4fe3f9e86869c71fa0c79b/davusevatedurodukozekugi.pdf
• https://slavica.ru/wp-content/plugins/super-forms/uploads/php/files/2f43e02445bfe5d19efe7e915f936060/gomutomeburul.pdf
• https://fiambreszav.com/wp-content/plugins/super-forms/uploads/php/files/57b9112fcebbb77e09048b35e411c35c/70331773619.pdf
• http://chocolatycakes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160716dad53951---wodofizurosawugarigogetej.pdf
• https://petrovsky14.ru/docs/files/zazoxizipuregimivok.pdf
• http://friluftsgruppen.se/wp-content/plugins/formcraft/file-upload/server/content/files/16080e90493f14---pepovezekudan.pdf
• http://www.putnamtaxi.net/wp-content/plugins/formcraft/file-upload/server/content/files/16082e32ce72c9---gaxelasexesemuf.pdf
• http://zs-oilfieldequip.ru/d/files/73589320112.pdf
• http://moto-bike.pl/userfiles/file/98226599202.pdf
• http://gandolfiarchitetti.com/userfiles/files/zulorulizozazomajejur.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• philabc.ru
• winston-woodward.com
• www.jhannahs.com
• cedresarquitectura.com
• idfusionllc.com
• xn--939a66v0zjo3bcvdmrp.com
• naseeha.org
• slavica.ru
• fiambreszav.com
• chocolatycakes.com
• petrovsky14.ru
• friluftsgruppen.se
• www.putnamtaxi.net
• zs-oilfieldequip.ru
• moto-bike.pl
• gandolfiarchitetti.com
• www.w3.org
• purl.org
• ns.adobe.com
• mfplus.ba
• www.sunargrup.com.tr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report