MALICIOUS — 7628291.pdf

MALICIOUS — 7628291.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 88df5b259a52c02638b04efc3704253feef95b36d9f945728cdba090f50bb55d
• SHA-1: 1870716e7f306e4d6bb3d91330083e40c22095ad
• MD5: bf59c8aec9f8e1d4926e3243a84af134
• ssdeep: 1536:Extj+LAdJlxjKniKEcPGZ0WGCCCM4BBwFDsT70/AO8jLb+2mokF8:uGUrUW2/WRc4Be7/AOsm22S
• TLSH: T15538CFF761D7DD4C798BAF93A9A72558B089834921218B51008CB76CC9BC77E7F20E41
• Submitted as: 7628291.pdf
• File type: pdf · Size: 77864 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!BF59C8AEC9F8
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://raketesi.weebly.com/uploads/1/3/4/6/134632322/zatubilodufiziz-zubobajux.pdf, https://mawegovif.weebly.com/uploads/1/3/5/3/135319367/davatinivef.pdf, https://kivuxobusev.weebly.com/uploads/1/3/1/8/131871605/4639494.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://feedproxy.google.com/~r/wb/ENAH/~3/kMuynZNWtA0/wb?keyword=envelope%20uk%20address%20format%20international
• https://raketesi.weebly.com/uploads/1/3/4/6/134632322/zatubilodufiziz-zubobajux.pdf
• https://mawegovif.weebly.com/uploads/1/3/5/3/135319367/davatinivef.pdf
• https://kivuxobusev.weebly.com/uploads/1/3/1/8/131871605/4639494.pdf
• https://uploads.strikinglycdn.com/files/fbfde2a6-5263-4c98-8d86-232c49d355b8/44451187175.pdf
• https://cdn-cms.f-static.net/uploads/4410432/normal_604f98350280c.pdf
• https://uploads.strikinglycdn.com/files/a88ddf0c-f16f-49db-bf0b-20907439dc86/how_to_get_a_star_border_on_word.pdf
• https://jowidirususonin.weebly.com/uploads/1/3/0/7/130775515/muwidegupale-rurifaz-gusoxot.pdf
• https://uploads.strikinglycdn.com/files/30c609f8-0f23-448e-bee9-9f5a0600d74f/the_giver_chapter_12_and_13_questions.pdf
• https://uploads.strikinglycdn.com/files/4b03d22a-8199-416d-8e19-bbd9e2bd63ae/what_is_chemical_energy_for_kids.pdf
• https://uploads.strikinglycdn.com/files/f16c33a8-69c7-41de-8553-c5791b18e35e/how_to_turn_on_chamberlain_garage_door_opener.pdf
• https://uploads.strikinglycdn.com/files/cb872dae-d29e-49f7-abba-915950e1ab8e/letokaxajirilibixivifovob.pdf
• https://janonezofeto.weebly.com/uploads/1/3/4/6/134664798/xitebanivizijuz.pdf
• https://uploads.strikinglycdn.com/files/33c406d6-7a0a-4dbe-aed8-8790b9da16a3/nuvi_2589_traffic_cable.pdf
• https://uploads.strikinglycdn.com/files/0eed7da3-f747-47fb-b526-ef7daaa5d7c7/26447660192.pdf
• https://uploads.strikinglycdn.com/files/d5fe7684-c22f-422b-99ab-568a61298f40/fatifaneri.pdf
• https://uploads.strikinglycdn.com/files/a6deeeb5-cc52-4348-aabe-a171778ef043/howard_gardners_theory_of_multiple_intelligences_definition.pdf
• https://static.s123-cdn-static.com/uploads/4413000/normal_6008453488f08.pdf
• https://uploads.strikinglycdn.com/files/005c1acf-39f3-4d49-a181-9a216239cb41/pattern_magic_2_espaol_gratis.pdf
• https://uploads.strikinglycdn.com/files/13dbd945-fa5f-40aa-8205-abe9eb7549db/vigijurubasewaviz.pdf
• https://wisomekusarukit.weebly.com/uploads/1/3/5/3/135384288/8fac6be100309f.pdf
• https://lutoropekitixes.weebly.com/uploads/1/3/1/3/131384777/c463a3dd451.pdf
• https://uploads.strikinglycdn.com/files/cbfee1cf-5830-47da-9c0c-8fb6ade00337/immortal_in_death_jd_robb.pdf
• https://uploads.strikinglycdn.com/files/6d8f976b-ac0f-4fa0-89b9-4e19e4f58d74/64917695032.pdf
• https://cdn-cms.f-static.net/uploads/4368496/normal_6067183500a64.pdf

Embedded domains

• feedproxy.google.com
• raketesi.weebly.com
• mawegovif.weebly.com
• kivuxobusev.weebly.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• jowidirususonin.weebly.com
• janonezofeto.weebly.com
• static.s123-cdn-static.com
• wisomekusarukit.weebly.com
• lutoropekitixes.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report