MALICIOUS — 1609f24c7b1db9---38250591810.pdf

MALICIOUS — 1609f24c7b1db9---38250591810.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 72d4efe50ff23fb44e33aab68fa9f426c0124227b8186b586c7da0ec02c5c9ff
• SHA-1: a2f454056fd1ffd879540cf6adadabc50467989f
• MD5: 856dc2a75e7e8cf6f8ed553268f1e869
• ssdeep: 1536:GaGdPj/mYXXNDtArs/t0zgAihuJzVERhpntxeuIrmT:u/mYXXNB+Jzgvu4RhpntYumG
• TLSH: T12137BFF3718BCD4CB6929B437DF614286889E3592172DA6444C8B3ACC8AC5BE6D14D05
• Submitted as: 1609f24c7b1db9---38250591810.pdf
• File type: pdf · Size: 72894 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!856DC2A75E7E

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://www.taxikladis.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160703e44be630---15028635700.pdf, https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608cdfa81a10a---rolelinoletesitabisodotu.pdf, http://hasyo.net/files/file/mifoxonadagixidanematod.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/zMnd8XtcwSM/uplcv?utm_term=jaspersoft+report+server+active+directory
• https://www.taxikladis.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160703e44be630---15028635700.pdf
• https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608cdfa81a10a---rolelinoletesitabisodotu.pdf
• http://hasyo.net/files/file/mifoxonadagixidanematod.pdf
• https://drainscovers.com/wp-content/plugins/super-forms/uploads/php/files/18fa22e4a9edc6ca0df98cb99d0de4c7/lusefativowebixegiwiwofig.pdf
• http://alliusie.com/userfiles/file/rukejeguzepoxaxobabufole.pdf
• https://www.lightingdynamics.com/wp-content/plugins/super-forms/uploads/php/files/d9db6941dc17df68435714b8764161f1/83104815008.pdf
• https://www.ideaklinikankara.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ac801aac91---goxobata.pdf
• https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077208c9ea97---38924968525.pdf
• https://www.zulilighting.com/wp-content/plugins/super-forms/uploads/php/files/0d0307ba13d6d783d389424d53621849/nejipajokav.pdf
• http://turnyras.lt/Files/file/69962340354.pdf
• https://mebelpozakazu.ru/wp-content/plugins/super-forms/uploads/php/files/0fb74ecfac05a62dc62cd8716629c61c/13203021485.pdf
• https://botorka.ro/userfiles/file/xirikivetomojisivalorin.pdf
• http://www.gunyagder.org.tr/wp-content/plugins/super-forms/uploads/php/files/qo58cmk76emr1q6t7cf0t64s50/32634703981.pdf
• https://www.mclarenpress.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b746c3f084---nisosukete.pdf
• http://adoriantarla.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16097fd01ce452---72348774599.pdf
• https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/3aeab3b4d9417abb74049b235bd1d167/83519388653.pdf
• http://mirrorgallery.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070783ac6139---pasokuve.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• www.audifonosdoshoydos.com
• hasyo.net
• drainscovers.com
• alliusie.com
• www.lightingdynamics.com
• www.ideaklinikankara.com
• drivingschoolofnorthtexas.com
• www.zulilighting.com
• mebelpozakazu.ru
• www.mclarenpress.com
• amezdigital.com
• mirrorgallery.com
• www.w3.org
• purl.org
• ns.adobe.com
• www.taxikladis.gr
• turnyras.lt
• botorka.ro
• www.gunyagder.org.tr
• adoriantarla.ro

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report