MALICIOUS — 30579060692.pdf

MALICIOUS — 30579060692.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 8565f2fa4f8582519d2cb39e057f443fd8f844359b03c81e3630700ba6f44f97
• SHA-1: 341fa560d6f5d7ae89fcd89e18dbd79502d237bc
• MD5: b58d53f625edb4e957342f65669cc9d9
• ssdeep: 1536:rx9NVdctJ8b3HLNVmkZX21hazNJ3ORIMHvC2FkaWf+r5SYXmpyvZW8pO7E0KQGKE:lJWtcr+kZm1hazNJ+RIMH6hMVmcvw7Ev
• TLSH: T16538BFF3129BCD4C72DB9F136CAA01E9B049E68C2663EB40548CB26CD57CABD6F14512
• Submitted as: 30579060692.pdf
• File type: pdf · Size: 81878 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://allytemp.ru/uplcv?utm_term=attached+book+pdf+download+free, https://hr-serdahel.hu/images/file/zebukibelakazemujapojo.pdf, http://giga.sk/storage/file/jopenavoko.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://allytemp.ru/uplcv?utm_term=attached+book+pdf+download+free
• https://hr-serdahel.hu/images/file/zebukibelakazemujapojo.pdf
• http://giga.sk/storage/file/jopenavoko.pdf
• http://www.depomatrial.com/file/bakin.pdf
• http://cohn-vossen.com/wp-content/plugins/formcraft/file-upload/server/content/files/16134ffcb6660c---37520879248.pdf
• http://yucehukuk.com/resimler/files/36019432741.pdf
• http://smingames.com/ckfinder/files/boferoga.pdf
• https://www.marthatrotts.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1613895fe10b3b---89111325116.pdf
• http://tweedehandswikkelaar.nl/app/webroot/files/userfiles/files/zorapasafi.pdf
• https://satybharat.com/ci/userfiles/files/tibawizojubevigurajutagen.pdf
• https://cvconstructionsgoa.com/pharma/admin/userfiles/file/81653080209.pdf
• http://diplomat2014.ru/ckfinder/userfiles/files/kuwalukapivosawisag.pdf
• http://chelseacarpet.com/ckfinder/userfiles/uploads/63128803423.pdf
• https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/51decfd0cfd4200c450c5d9d5cebc2a9/tomonavupuzexalowulane.pdf
• http://landroverbh.com/ckfinder/userfiles/files/17578339815.pdf
• http://morecoredesign.com/images/imageUps/files/kaguxiripegibuvi.pdf
• http://aescantabria.es/upload/fckeditor/file///35467221790.pdf
• http://www.mediagrand.hu/data/editorfile/pepawafuwejegovit.pdf
• http://showdoimovel.com/files/files/93988309403.pdf
• http://www.radanhorse.com/resource/files/gefadusugewaxuxikobajoba.pdf
• https://legacydockandmarine.com/wp-content/plugins/super-forms/uploads/php/files/522083a1526254af08d239c4de110586/91001638832.pdf
• https://china-glass-mosaic.com/userfiles/files/20210831_184948.pdf
• http://nemdanangpho.com/uploads/2021-09-09/images/files/durovonejegoxomekomag.pdf
• http://kochamsushi.pl/UserFiles/file/43996077082.pdf
• https://dichvumayphoto.vn/webroot/img/files/gavuzap.pdf

Embedded domains

• allytemp.ru
• www.depomatrial.com
• cohn-vossen.com
• yucehukuk.com
• smingames.com
• www.marthatrotts.ca
• tweedehandswikkelaar.nl
• satybharat.com
• cvconstructionsgoa.com
• diplomat2014.ru
• chelseacarpet.com
• noble-worldwide.com
• landroverbh.com
• morecoredesign.com
• aescantabria.es
• showdoimovel.com
• www.radanhorse.com
• legacydockandmarine.com
• china-glass-mosaic.com
• nemdanangpho.com
• kochamsushi.pl
• www.w3.org
• purl.org
• ns.adobe.com
• hr-serdahel.hu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report