MALICIOUS — 1609e850805cdb---buwuwetikifukazowi.pdf

MALICIOUS — 1609e850805cdb---buwuwetikifukazowi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 8677c346f095297e68cc23ebd5f3240a8a71269ce166c48263e66a5972cda5df
• SHA-1: 597c3a4e1d22cca567e454147e452ead74f7c7a3
• MD5: a51afae51fda597d4f5842b506b71ad4
• ssdeep: 1536:eFR0hGivQs2dc7Z9NkRSACTqDG118IJB0uHsm75LQwixPY9rGbnCh0rB2pt:oCsDdWHkRSACTqqYIH2mnGPNDCh0r6t
• TLSH: T17A38E0F3A047DE8DB68A4B535AF71178104BD68DA063DE9054C8B7AC95BC2BC3E18522
• Submitted as: 1609e850805cdb---buwuwetikifukazowi.pdf
• File type: pdf · Size: 77709 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!A51AFAE51FDA
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://creativeindustries.ru/uploads/userfiles/file/fapimaxutijowit.pdf, https://engravestone.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086f514b7970---loxogarexalilituduvam.pdf, http://thehawthornnyc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075a82b1c2af---3659915659.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=lucida+handwriting+normal+font+free
• http://creativeindustries.ru/uploads/userfiles/file/fapimaxutijowit.pdf
• https://engravestone.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086f514b7970---loxogarexalilituduvam.pdf
• http://thehawthornnyc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075a82b1c2af---3659915659.pdf
• http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/1608408c536e0b---51632396740.pdf
• https://beaumont-residence.com/wp-content/plugins/super-forms/uploads/php/files/emgk4auqcvks34llsoo29qg7vd/37584829275.pdf
• http://absolutelyneon.com/userfiles/file/38210238771.pdf
• http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d150265552---tunejuroxalu.pdf
• http://www.virtualaid.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1608c0a30e29fb---kiwagovizosifonowe.pdf
• http://gymostrov.org/gymostrov/userfiles/file/79042303294.pdf
• http://alnoorcity.com/userfiles/file/34612992183.pdf
• https://spaslask.pl/wp-content/plugins/super-forms/uploads/php/files/3r6u45lfd8qnjc483mr5fopdi0/rufomarigamutitofire.pdf
• https://jamiatulbanat.in/wp-content/plugins/formcraft/file-upload/server/content/files/16072ac6c69970---bixomibuxobuwaworikile.pdf
• https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075e90d49c36---ledupewos.pdf
• https://lasvegasrebath.com/wp-content/plugins/super-forms/uploads/php/files/795f7600a520aef1f07fdb704f004f36/55022432409.pdf
• https://sygimportaciones.com/wp-content/plugins/super-forms/uploads/php/files/080e35b0qu08ro3acvnqnc5cbd/kavuwagi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• creativeindustries.ru
• engravestone.com
• thehawthornnyc.com
• www.miamiairportlimo.net
• beaumont-residence.com
• absolutelyneon.com
• totaleclipsenv.com
• www.virtualaid.eu
• gymostrov.org
• alnoorcity.com
• spaslask.pl
• jamiatulbanat.in
• trucraftsmanship.com
• lasvegasrebath.com
• sygimportaciones.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report