MALICIOUS — d40554_190c3b6fd879457283e89f818cc47f98.pdf

MALICIOUS — d40554_190c3b6fd879457283e89f818cc47f98.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 81bb2755842e5d3d6389b1327d15c6968ebbfc04b1904bda4e1d9bd736c17490
• SHA-1: 2b19f0f96ede549cf80f3df5ccef2cbf3822057c
• MD5: 78e5a7a666d117f5c1e9eb05b30e58bb
• ssdeep: 1536:jLslzfGNRXhb01lP1O1VIYnVcZW52X0tlvZIGLq3FgnSCn:CrGNjyP1OuYVcS2yvZIGLuFwh
• TLSH: T19237D0F32097EC8CBBCAAB4369B759395089E7C97533D7641884A76CC07CA2D3E14941
• Submitted as: d40554_190c3b6fd879457283e89f818cc47f98.pdf
• File type: pdf · Size: 75960 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!78E5A7A666D1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://yafferge.ru/wix?keyword=plc+troubleshooting+guide+pdf, https://cdn.sqhk.co/lojibuwe/jhGggWU/relowivenujot.pdf, http://fodimezafizuver.epizy.com/fakaxekubamevizexapaxe.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://yafferge.ru/wix?keyword=plc+troubleshooting+guide+pdf
• https://cdn.sqhk.co/lojibuwe/jhGggWU/relowivenujot.pdf
• https://s3.amazonaws.com/bulozor/best_autumn_wallpaper_android.pdf
• http://fodimezafizuver.epizy.com/fakaxekubamevizexapaxe.pdf
• https://s3.amazonaws.com/wixanarer/casual_leave_application.pdf
• https://cdn.sqhk.co/nobukomorur/gc0CwlD/piganumuregukilozipipipa.pdf
• https://cdn.sqhk.co/vomawoko/gqhg2bR/gibetuxolabogede.pdf
• https://cdn.sqhk.co/risevejuxik/gdjcof0/90739975249.pdf
• http://zotegomowivin.22web.org/72049806120.pdf
• https://cdn.sqhk.co/wazotifuk/ahhujf9/contract_whist_online.pdf
• https://s3.amazonaws.com/gajakelegeza/11929275173.pdf
• https://s3.amazonaws.com/veraxawewib/numizelebetifapelasimul.pdf
• https://s3.amazonaws.com/lefemijip/alien_vs_predator_game_pc.pdf
• https://s3.amazonaws.com/vitelitubovuluj/64152123533.pdf
• https://s3.amazonaws.com/fajonubinomeder/email_template_freelance_work.pdf
• https://s3.amazonaws.com/dadupawo/flashlight_piano_sheet_beginner.pdf
• https://s3.amazonaws.com/kifutizijebuj/158211545.pdf
• https://cdn.sqhk.co/rewazexi/iaEiijc/31099548903.pdf
• http://pobediwawe.epizy.com/international_women_s_clothing_size_guide.pdf
• http://damufabenipete.rf.gd/wutotu.pdf
• https://s3.amazonaws.com/wonumafubij/how_do_i_program_my_subaru_homelink_garage_door_opener.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• yafferge.ru
• cdn.sqhk.co
• s3.amazonaws.com
• fodimezafizuver.epizy.com
• zotegomowivin.22web.org
• pobediwawe.epizy.com
• www.w3.org
• purl.org
• ns.adobe.com
• damufabenipete.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report