MALICIOUS — 40613967229.pdf

MALICIOUS — 40613967229.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 6fb4d7b60fbd005404c92390ef5a23ce5848da22fb0212d7fdab9665e12d2961
• SHA-1: ed614a1397e50c2c8810450c4c9f38ba5a9da94f
• MD5: abde44a97a0abfcd3a131638307cfc41
• ssdeep: 1536:yL43NGJW6YIBfkzNDc0yFrFhDixIJ44OpWjCArfPDQWeCWspO25uM:U2NkHZkJIFrFpJndrXDQvJ2f
• TLSH: T1DB37BFF361D7DD8C77879B4378F620A8944DD64C62A2EB408088B67C95FC67DBE14610
• Submitted as: 40613967229.pdf
• File type: pdf · Size: 70731 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://laborke.ru/uplcv?utm_term=coin+master+server+hack, http://saiprogetti.net/userfiles/files/xalutesuvipup.pdf, http://lawyergz.net/uploadfile/files/16881863920.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://laborke.ru/uplcv?utm_term=coin+master+server+hack
• http://saiprogetti.net/userfiles/files/xalutesuvipup.pdf
• http://lawyergz.net/uploadfile/files/16881863920.pdf
• https://tspinstruments.com/cache/fck_files/file/65457709364.pdf
• http://nhakhoauytinhaiphong.com/upload/files/67602438683.pdf
• http://offerparts.com/upload/files/lomororasukiwedov.pdf
• http://globalbando.com/DATA/upload/files/202109010635417285.pdf
• http://www.patricktennis.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16145148d11585---kamesebezatova.pdf
• http://gtlmarinefuel.com/userfiles/file/gisari.pdf
• http://go-trec.com/wp-content/plugins/super-forms/uploads/php/files/ialhqud1qvui5hjv9e83net0o0/12438336375.pdf
• http://potya.com/zaxobu.pdf
• https://djecijagarderoba.me/userfiles/file/19614116083.pdf
• https://tungafilm.com/dorceiys/ckfinder/userfiles/files/86512017600.pdf
• http://www.opencalgary.org/wp-content/plugins/formcraft/file-upload/server/content/files/161447b9cb47e3---55186272391.pdf
• http://cambresisemploi.fr/ckfinder/userfiles/files/gifipemuxirot.pdf
• https://we-plus.tw/ckfinder/userfiles/files/44177944809.pdf
• https://directprocessors.com/wp-content/plugins/formcraft/file-upload/server/content/files/16145106068081---92337244393.pdf
• http://methese.com/upload/files/dafasezujobuxu.pdf
• http://veewood.com/file_media/file_image/file/89589475978.pdf
• http://alpes-de-haute-provence.proximeo.com/ckfinder/userfiles/files/90071925357.pdf
• https://aalatour.com/basefile/b2caalatourcom/files/69043660711.pdf
• http://bischofs-scheune.de/userfiles/file/64463063195.pdf
• https://2b3la571ga-70p.com/contents/files/fupomasa.pdf
• http://de-ko-gmbh.com/ckfinder/userfiles/files/15215762516.pdf
• https://propactionvehiclesuk.tv/userfiles/files/8389300196.pdf

Embedded domains

• laborke.ru
• saiprogetti.net
• lawyergz.net
• tspinstruments.com
• nhakhoauytinhaiphong.com
• offerparts.com
• globalbando.com
• www.patricktennis.nl
• gtlmarinefuel.com
• go-trec.com
• potya.com
• djecijagarderoba.me
• tungafilm.com
• www.opencalgary.org
• cambresisemploi.fr
• we-plus.tw
• directprocessors.com
• methese.com
• veewood.com
• alpes-de-haute-provence.proximeo.com
• aalatour.com
• bischofs-scheune.de
• 2b3la571ga-70p.com
• de-ko-gmbh.com
• propactionvehiclesuk.tv

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report