MALICIOUS — 8c7f2d50b114669d816ccbd917ffb55e7ea1ede95d93ff25dc757c512b9f1e78

MALICIOUS — 8c7f2d50b114669d816ccbd917ffb55e7ea1ede95d93ff25dc757c512b9f1e78 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 8c7f2d50b114669d816ccbd917ffb55e7ea1ede95d93ff25dc757c512b9f1e78
• SHA-1: 7d3e1481af51615957ebc774a7d105dbcc9e5f29
• MD5: de21423aad21d0a93428d34c03d0b336
• ssdeep: 1536:2dyB4jKATH4o6R4f48yFIlzLNUnmwmW6pOu26WzVy5ZT50CgB5jZED:l4K6H/o4nyFI4mku2yjTtg7e
• TLSH: T1BE39D0F761AFDD4C7B9A8703B9B722699046E2887172E6A0048CB77CC57C5BDBE10901
• Submitted as: 8c7f2d50b114669d816ccbd917ffb55e7ea1ede95d93ff25dc757c512b9f1e78
• File type: pdf · Size: 88029 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://megatex-plast.ru/pub/file/kaditokevixebox.pdf, https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/0703f07c74b650351a2323eb4a3dfebd/paxetureb.pdf, http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16157258511236---92898155214.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/ngfLrbzwjls/uplcv?utm_term=passing+out+after+one+drink
• http://megatex-plast.ru/pub/file/kaditokevixebox.pdf
• https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/0703f07c74b650351a2323eb4a3dfebd/paxetureb.pdf
• http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16157258511236---92898155214.pdf
• http://babijie.com/upload_fck/file/2021-9-16/20210916114606515131.pdf
• https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/e717da4c45bd96be014df9dd99762739/zuwemelitogumul.pdf
• http://maremio.ru/admin/ckfinder/userfiles/files/zoguxodofokakaza.pdf
• http://vicc.huh.hu/UserFiles/File/95849434953.pdf
• http://tovicetour.com/FileData/ckfinder/files/20210909_2699ADC90E27C263.pdf
• https://ntpuvoice.com/ckfinder/userfiles/files/14472124466.pdf
• https://sikdercollegeofpharmacy.com/scp/ckfinder/uploads/userfiles/files/dafija.pdf
• http://musicincw.com/fckeditor/userfiles/image/rodedusakujosajumakew.pdf
• https://ksi-system.pl/editorfiles/file/pivogumetegesolawem.pdf
• https://hongmao.tw/uploads/files/202109281738378834.pdf
• https://coachtourbusrental.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136f3f5d162c---tetajizepajutadejoven.pdf
• http://doingthing.com/downloads/blog/geust/files/88243557851.pdf
• https://fwstc.in/userfiles/file/xenabozidijatulewu.pdf
• http://newgrids.com/userfiles/file/bafonezeriroka.pdf
• https://saint-florentin.charcutier-traiteur.fr/ckfinder/userfiles/files/66664066754.pdf
• http://decentlogistics.pk/survey/userfiles/files/muzavafijemagiwojinu.pdf
• http://bakefruit.com/uploads/files/202109130612342491.pdf
• http://l-max.ru/userfiles/file/88810423729.pdf
• http://amwordpress.org/wp-content/plugins/formcraft/file-upload/server/content/files/16141f97fd4719---polavebokeperajubaf.pdf
• http://nelly-design.ru/upload/files/bebevixetuvodesenuwavu.pdf
• http://symbolfoods.com/files/file///59801382599.pdf

Embedded domains

• feedproxy.google.com
• megatex-plast.ru
• givemeit.ru
• artmetinc.com
• babijie.com
• kvartira-zalog.ru
• maremio.ru
• tovicetour.com
• ntpuvoice.com
• sikdercollegeofpharmacy.com
• musicincw.com
• ksi-system.pl
• hongmao.tw
• coachtourbusrental.com
• doingthing.com
• fwstc.in
• newgrids.com
• saint-florentin.charcutier-traiteur.fr
• bakefruit.com
• l-max.ru
• amwordpress.org
• nelly-design.ru
• symbolfoods.com
• www.w3.org
• purl.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report