MALICIOUS — 62ef4af2ad475c3bb929200877ab0b99f19b521e9d5a9d7e59ca1e045acf7b60

MALICIOUS — 62ef4af2ad475c3bb929200877ab0b99f19b521e9d5a9d7e59ca1e045acf7b60 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

SHA-256: 62ef4af2ad475c3bb929200877ab0b99f19b521e9d5a9d7e59ca1e045acf7b60
SHA-1: c9f880bc34e6d1ddf59095cc6693edb19d3b866f
MD5: c2077353d7771decb511af9d57ad689b
ssdeep: 1536:PAAdNg3inOiHpGL5A52TBZobWkvqKWapOtQwpKaxuerbmTc:4ANOiJGL5A52tZQq3tQwpKa9p
TLSH: T10037BEF3519BDDAC7786CB937EA6115C658AC7892171DA6050C8763C88BC9BEFE00B40
Submitted as: 62ef4af2ad475c3bb929200877ab0b99f19b521e9d5a9d7e59ca1e045acf7b60
File type: pdf · Size: 70208 bytes
Verdict: malicious (92/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://archism.ru/uplcv?utm_term=the+walking+dead+free+streaming+online, https://grahampropertytax.com/wp-content/plugins/super-forms/uploads/php/files/271d5dfee77d44c0d70495d76492a68b/vigusijegaluzapavewete.pdf, http://mh-gartengestaltung.de/userfiles/file/wizup.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://archism.ru/uplcv?utm_term=the+walking+dead+free+streaming+online
https://grahampropertytax.com/wp-content/plugins/super-forms/uploads/php/files/271d5dfee77d44c0d70495d76492a68b/vigusijegaluzapavewete.pdf
http://mh-gartengestaltung.de/userfiles/file/wizup.pdf
http://m-camper.ru/ckfinder/userfiles/files/57644620374.pdf
http://cnzhongkui.com/fckeditor/editor/filemanager/connectors/php/uploads/file/120409558650.pdf
https://darkoyunpin.com/calisma2/files/uploads/35468151625.pdf
http://etkindenetim.com/resimler/files/28987948981.pdf
http://parcroyale.hk/userfiles/69518694890.pdf
http://bularz-auto.pl/images/userfiles/file/35506275323.pdf
http://ziva-muzika.cz/files/file/78027771241.pdf
http://www.saveurspoitoucharentes.com/admin/ckfinder/userfiles/files/petusapamujisunusijokun.pdf
https://bunexim.dascalita.ro/app/webroot/files/userfiles/files/fisefa.pdf
https://tonymusic.se/UserFiles/files/54119294595.pdf
https://spacio.hk/attachment/file/25864340697.pdf
https://termoformat.md/img/files/14978417571.pdf
http://findingthegrey.com/userfiles/file/darelovekerivakesu.pdf
http://veterky.ru/ckfinder/userfiles/files/dujutapiroxivuxuwid.pdf
http://crimesla.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/velobobelupu.pdf
https://giritrademark.com/content_files/files/buvolako.pdf
http://keacg.com/upload/files/18234442697.pdf
http://mywayrtk.org/userfiles/file/49248056097.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

archism.ru
grahampropertytax.com
mh-gartengestaltung.de
m-camper.ru
cnzhongkui.com
darkoyunpin.com
etkindenetim.com
parcroyale.hk
bularz-auto.pl
www.saveurspoitoucharentes.com
tonymusic.se
spacio.hk
findingthegrey.com
veterky.ru
crimesla.com
giritrademark.com
keacg.com
mywayrtk.org
www.w3.org
purl.org
ns.adobe.com
ziva-muzika.cz
bunexim.dascalita.ro
termoformat.md

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report