MALICIOUS — 74936a655f7381815cbd8487602cdc453020c36fbe851c39e79d4c26980ad558

MALICIOUS — 74936a655f7381815cbd8487602cdc453020c36fbe851c39e79d4c26980ad558 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 74936a655f7381815cbd8487602cdc453020c36fbe851c39e79d4c26980ad558
• SHA-1: 6455e54446f5fe2c2867094b233dbd311f2048a4
• MD5: 4f20f564451c420c208afb545fe59569
• ssdeep: 1536:dWnBWMq1gm/GGWDYtNYnn6xKLvW2e3hmb/3CbsWspO2a3:onsD1gm/GAEn6UHb/3Cbf2a
• TLSH: T18037C0F32087CD9CBA8BDB43A9A75278644BE78D50B2DB800188B72C95BC57DBF10651
• Submitted as: 74936a655f7381815cbd8487602cdc453020c36fbe851c39e79d4c26980ad558
• File type: pdf · Size: 70547 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://phutungvespaco.com/luutru/files/ruvapaxokopogifinirij.pdf, http://studiotecnicodama.it/userfiles/files/zodoxupofejo.pdf, https://uaqbakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613551f211d66---jexiro.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=the+call+2020+korean+movie+watch+online
• http://phutungvespaco.com/luutru/files/ruvapaxokopogifinirij.pdf
• http://studiotecnicodama.it/userfiles/files/zodoxupofejo.pdf
• https://uaqbakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613551f211d66---jexiro.pdf
• http://campingwithconvenience.com/files/files/36037139233.pdf
• https://www.lucaslobker.com/minor/ckfinder/userfiles/files/60821706678.pdf
• http://www.britocunhaadvocacia.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/1614049852757b---tabare.pdf
• https://yoimart.com/upload/file/20210904050723.pdf
• http://careerpathrecruitment.com/swapscan/app/webroot/js/ckfinder/userfiles/files/83330822928.pdf
• http://tecs4.com/intranet/ckfinder/userfiles/files/lapigibemigegugemisuboneg.pdf
• http://kolbiko.com/images/uploads/file/79888106754.pdf
• http://innova-perila.ru/upload/files/nupisiposijobuxerol.pdf
• http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1613eace7e8ad9---vutilagipukeme.pdf
• http://etkenkalip.com/files/sujatiwovazajazaxib.pdf
• https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/db76f0ba058c3d01d310f0d29dc6c729/ginavexozuse.pdf
• http://turskazka.ru/ckfinder/userfiles/files/4181317220.pdf
• https://loan-financial.com/wp-content/plugins/super-forms/uploads/php/files/1c0e60c49f2d53856f4b6f28460827a0/35652273248.pdf
• http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/a0ac54967441c9817234dac823751579/budafuxirezulevoretosi.pdf
• https://ever-progress.com/upload/files/69688135106.pdf
• http://networkinglikepro.com/ckfinder/userfiles/files/muwibebevetofeniw.pdf
• https://maria-galland.ru/files/file/97479107918.pdf
• https://ptogel2.com/contents/files/7305959719.pdf
• https://ip-kamera-rendszer.nuttydog.hu/ckfinder/userfiles/files/25165745358.pdf
• http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614960ce8494d---42305736612.pdf
• http://flashdisplay.net/UploadFiles/FCKeditor/20210920134812.pdf

Embedded domains

• feedproxy.google.com
• phutungvespaco.com
• studiotecnicodama.it
• uaqbakery.com
• campingwithconvenience.com
• www.lucaslobker.com
• www.britocunhaadvocacia.com.br
• yoimart.com
• careerpathrecruitment.com
• tecs4.com
• kolbiko.com
• innova-perila.ru
• mijneigenlift.nl
• etkenkalip.com
• swimproject.eu
• turskazka.ru
• loan-financial.com
• www.rec39.ru
• ever-progress.com
• networkinglikepro.com
• maria-galland.ru
• ptogel2.com
• www.naturapreserved.com
• flashdisplay.net
• ip-kamera-rendszer.nuttydog.hu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report