MALICIOUS — 52536687016.pdf

MALICIOUS — 52536687016.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 61508df2169fa58da855bfef15fa4a3a2e20292f801bd27e81eeda22993f5048
• SHA-1: f299b4b1e11274f73f5c844ba33167dd685d48bf
• MD5: 4cb543c2aeca0cb0e1e54ca82256d68e
• ssdeep: 1536:HBNzejoH3bGX6gQmQLoyQBz3c297P6NFE3SOO:PoK6KnmQM5z3vGNAc
• TLSH: T1BC37D1F3228BDD5CB5CBDB4378FB16682486C2886522EB5444C8B77CE4AC2FD6D20910
• Submitted as: 52536687016.pdf
• File type: pdf · Size: 70847 bytes
• Verdict: malicious (96/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!4CB543C2AECA

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Kaspersky (KVRT) flagged HEUR:Hoax.PDF.Agent.gen (rule HEUR:Hoax.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: http://espiber.cl/images/uploadedimages/file/paxezimegowilonudotujo.pdf, http://ypdtools.com/ckfinder/images_store/files/25441428979.pdf, https://noithathoaphat11.com/upload/files/gizibiwuvikuvefodinute.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/DOqCt-cVA4I/uplcv?utm_term=active+and+passive+voice+exam
• http://espiber.cl/images/uploadedimages/file/paxezimegowilonudotujo.pdf
• http://ypdtools.com/ckfinder/images_store/files/25441428979.pdf
• https://noithathoaphat11.com/upload/files/gizibiwuvikuvefodinute.pdf
• http://gingerbreadvillage.org/clients/e/e3/e396b250b60561adcb946853f9f62e29/File/93390115700.pdf
• https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/1607a000cd797c---21255065392.pdf
• http://clinicaveterinariailmarzocco.it/userfiles/files/jutozuvalodetadarasiv.pdf
• https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/160944c2fd44cf---1806660500.pdf
• https://harkakotony.hu/UserFiles/file/bokujurepo.pdf
• https://lawpropertyconsultants.co.uk/wp-content/plugins/super-forms/uploads/php/files/pd2r3uvj0ej4rme49m2qv270ie/gebukazunelevanimis.pdf
• http://chandigarhdatarecovery.com/files/file/wiwafavafoguxe.pdf
• http://mikomisushiwc.com/uploads/files/95382200588.pdf
• http://dangkykinhdoanhkiengiang.com/upload/ck/files/54149582316.pdf
• http://heilpraxis-pankow.de/wp-content/plugins/formcraft/file-upload/server/content/files/16071d71c8e610---86901401424.pdf
• https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b4df3d9fe5a---25712797518.pdf
• http://cameronhaddock.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606efe1e0d240---xepamejotilerigisemujur.pdf
• https://monacollection.ua/wp-content/plugins/super-forms/uploads/php/files/5de20b9cd56e55aeeed4f3f3315244bc/lininewijerowapi.pdf
• https://ceral.pl/ceral/pliki/file/84083538667.pdf
• http://selfmadefilms.nl/userfiles/files/mavuravimaradofi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• ypdtools.com
• noithathoaphat11.com
• gingerbreadvillage.org
• clinicaveterinariailmarzocco.it
• frennphotography.com
• lawpropertyconsultants.co.uk
• chandigarhdatarecovery.com
• mikomisushiwc.com
• dangkykinhdoanhkiengiang.com
• heilpraxis-pankow.de
• www.darrellstuckey.com
• cameronhaddock.com
• monacollection.ua
• ceral.pl
• selfmadefilms.nl
• www.w3.org
• purl.org
• ns.adobe.com
• espiber.cl
• www.tai.gr
• harkakotony.hu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report