MALICIOUS — 70753b9d6f27260ba39a3e77fbb55520d39562f26575fef42cc2c9d6b3b55b80

MALICIOUS — 70753b9d6f27260ba39a3e77fbb55520d39562f26575fef42cc2c9d6b3b55b80 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 70753b9d6f27260ba39a3e77fbb55520d39562f26575fef42cc2c9d6b3b55b80
• SHA-1: eaccfc7df7abd4caa6c9e98aa4d5c07b91a3a90f
• MD5: a70c9d4f13da62677b0974036523eebd
• ssdeep: 1536:OiI0dpj+3nuNGpIA8Bb/gybJxis/6s2+/WOpOaZEWN24D/vxcM6nck:Brp3G+A8Bb/Tis/6R+QaZZ24D/vxJWck
• TLSH: T1B636D1F310D3DE0CF64F8B436EAB11F8558FE3886167E290418CA768946C9BE7E14A51
• Submitted as: 70753b9d6f27260ba39a3e77fbb55520d39562f26575fef42cc2c9d6b3b55b80
• File type: pdf · Size: 66508 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://ankurgroups.com/userfiles/file/pezinu.pdf, http://websurin.net/UserFiles/File/17156989265.pdf, https://parokisantolukas.org/Uploads/userfiles/files/18346600867.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=free+multiplying+fractions+worksheets
• http://ankurgroups.com/userfiles/file/pezinu.pdf
• http://websurin.net/UserFiles/File/17156989265.pdf
• https://parokisantolukas.org/Uploads/userfiles/files/18346600867.pdf
• https://zhbiotech.com/CKEdit/upload/files/11322459257.pdf
• https://rfcorporation.net/wp-content/plugins/super-forms/uploads/php/files/9861394b851ac746a916793575c666e3/difirivedibam.pdf
• https://hpsoft.shop/upload/files/73224738095.pdf
• http://www.davidwoodpersonnel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160886e6144001---9432680715.pdf
• http://upsshop.ru/ckfinder/userfiles/files/nebosonidomasat.pdf
• http://kimdaiphatsteel.com/Images_upload/files/54556576340.pdf
• https://carpanea.it/wp-content/plugins/super-forms/uploads/php/files/37415312a0cd9ab2714811e6d13e6044/mijejotiwiwiz.pdf
• http://capital96.com/userfiles/file/rabiginifowelagiwer.pdf
• https://cvconstructionsgoa.com/pharma/admin/userfiles/file/16325440491.pdf
• http://kk-gorenjska.si/uporabnik/file/70764680829.pdf
• http://www.pattyn360.com/upload/forum/files/98116291466.pdf
• http://perfekttorun.pl/pliki/55383234734.pdf
• http://unipell.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a1de2a0d463---15487142206.pdf
• https://dbjadow.pl/attachments/file/gufaxeloji.pdf
• http://banhangcongnghe.com/upload/FCK/file/97534575357.pdf
• http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/1607915fd6b946---lovexoboxaboze.pdf
• http://asalsold.com/wp-content/plugins/formcraft/file-upload/server/content/files/16133c0fd3ebd8---24834634565.pdf
• http://chapaconoticias.com/assets/ckfinder/core/connector/php/uploads/files/14227492364.pdf
• http://akbarestate.com/survey/userfiles/files/fujebisijafoza.pdf
• https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/516eig4fmgqdq31p3ui1u5gtk7/84219957412.pdf

Embedded domains

• feedproxy.google.com
• ankurgroups.com
• websurin.net
• parokisantolukas.org
• zhbiotech.com
• rfcorporation.net
• hpsoft.shop
• www.davidwoodpersonnel.com
• upsshop.ru
• kimdaiphatsteel.com
• carpanea.it
• capital96.com
• cvconstructionsgoa.com
• www.pattyn360.com
• perfekttorun.pl
• unipell.com.br
• dbjadow.pl
• banhangcongnghe.com
• www.cuerpomenteyespiritu.es
• asalsold.com
• chapaconoticias.com
• akbarestate.com
• www.frontierexim.com
• kk-gorenjska.si

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report