MALICIOUS — 160c87b07e73c9---30610614103.pdf

MALICIOUS — 160c87b07e73c9---30610614103.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 6 of 50 detection engines flagged it.

Identification

• SHA-256: 7f095eaf4a4c524d04516215a33909ac3cf95f1fc1cded958afd19685dccaf81
• SHA-1: ad4cfdcbf4298d7c20b87ca21e00f2456bdffee3
• MD5: d9055f1196d02fd9efcd7a7ddc9ddfcf
• ssdeep: 1536:UoE7D4m5AHJlorw8/iOU7LqxhddV15LCOoSUwZNE3PGZMqK2FJKig:o70m5AHzqw8/iON/noS3ZNe+ZIUJk
• TLSH: T17338D0F37647CE8DBB876B933AFA15697049D3981233DA440488BB6C80B857D7F01A61
• Submitted as: 160c87b07e73c9---30610614103.pdf
• File type: pdf · Size: 80313 bytes
• Verdict: malicious (92/100)

Detections (6 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!D9055F1196D0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cructi.ru/uplcv?utm_term=the+allegory+of+the+cave+symbols, https://laneopx.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098f6d9ead0b---sopulifonobalojarokorub.pdf, https://cedarcreeksauce.com/wp-content/plugins/super-forms/uploads/php/files/45c3c752a14f7aeba2ffd6ad5e0abc67/putenodedemidagaro.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cructi.ru/uplcv?utm_term=the+allegory+of+the+cave+symbols
• https://laneopx.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098f6d9ead0b---sopulifonobalojarokorub.pdf
• https://cedarcreeksauce.com/wp-content/plugins/super-forms/uploads/php/files/45c3c752a14f7aeba2ffd6ad5e0abc67/putenodedemidagaro.pdf
• http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a716074660---71006995004.pdf
• https://dhesient.com/media/48933858491.pdf
• http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/160732dab66556---71787761386.pdf
• https://lawyerupsmart.com/tempimg/file/66924024174.pdf
• https://shining4u.com/wp-content/plugins/super-forms/uploads/php/files/902d60739c8af112bca02ecb45ad5659/finopalulogofufatix.pdf
• https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/6c1d2b9e2da1ced3ff8b458269c07d15/wezukuzopabukiropisetiw.pdf
• https://www.popcaffe.it/wp-content/plugins/super-forms/uploads/php/files/760ef16824d0e493108cd25b9a5e2d93/tomuwafubevapamozo.pdf
• http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/r9v7it062t8d0sk7f87fknklv2/dewexuvur.pdf
• http://habitat3.eu/userfiles/files/95259664848.pdf
• http://inter-travel.hu/_user/file/7124653827.pdf
• https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/2d5e002068d6548ed15005f5bf029c6a/defutusemud.pdf
• https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/b3f6c6481057cfedf5ba025d7e1b447c/filexemigewe.pdf
• http://kino-profi.com/wp-content/plugins/super-forms/uploads/php/files/eca0089f59695d34822a6e0456a0af19/26138587749.pdf
• http://profisystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c415fe8e240---laviparudojuvadikifojeri.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cructi.ru
• laneopx.com
• cedarcreeksauce.com
• gingerwooddesign.com
• dhesient.com
• www.cuadernos.in
• lawyerupsmart.com
• shining4u.com
• wpsqld.com.au
• www.popcaffe.it
• www.x454.com
• habitat3.eu
• bistro-8.com
• agsposure.org
• kino-profi.com
• www.w3.org
• purl.org
• ns.adobe.com
• inter-travel.hu
• profisystem.ro

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report