MALICIOUS — 79189198764.pdf

MALICIOUS — 79189198764.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 954a3e6e08ebd6e2eadcc7c7449daf239d2ea8968f76304664971a42ff8e01df
• SHA-1: 9e55d121600f33ceed858b1a0f0812cef8b3379f
• MD5: 40c5716847cc2b3797b5e7503cb7c261
• ssdeep: 1536:UjLhEpZ/drW+4x0dR9VT5EMwB1hMTkSEttFjGuVWyoovIbupAGfdEWapOtQ8n5eB:Llrr4qdRnT5tTpEsu7oFmAgdltQ85Q
• TLSH: T15438D0F72097DE9C7A9ADF436997518CA48EE3C861A2D65011CCBA3CC53C6BDBE00650
• Submitted as: 79189198764.pdf
• File type: pdf · Size: 83235 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://synerhu.ru/uplcv?utm_term=imagine+dragons+demons+song+download+mp4, https://libertyrealestate.in/ckfinder/userfiles/files/kufozokuruwujomenenabuwum.pdf, https://thucphamtruongxanh.com/Upload/files/70867869015.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://synerhu.ru/uplcv?utm_term=imagine+dragons+demons+song+download+mp4
• https://libertyrealestate.in/ckfinder/userfiles/files/kufozokuruwujomenenabuwum.pdf
• https://thucphamtruongxanh.com/Upload/files/70867869015.pdf
• https://fulzugaskozpont.hu/files/wivasoniko.pdf
• http://zamel2.pl/userfiles/file/15280004507.pdf
• http://digilit.ir/basefile/digilitir/files/vumivunasusarokamoz.pdf
• http://lixupeng.com/uploads/files/nuvef.pdf
• http://commissioncollectionlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/47014506276.pdf
• http://7sate.com/filespath/files/20210909050256.pdf
• http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/16134f1a55adad---1154130798.pdf
• https://www.fishhabitatnetwork.com.au/application/third_party/ckfinder/userfiles/files/10591449732.pdf
• https://www.ezhealthcheck.com/wp-content/plugins/super-forms/uploads/php/files/41vqa6n08lq6vltj7kjoego1ie/zupozemisekuz.pdf
• https://bomando.bomsolar.com/uploadfiles/files/xisujidojasenima.pdf
• http://grandviewgroupresort.com/upload/files/84169126223.pdf
• http://duszek-lasu.pl/userfiles/file/kufoxazebuserisiwatujajix.pdf
• http://veraschwemmle.de/fckdata/file/99658662930.pdf
• https://lighthousemacau.com/html_upload/file/72368060193.pdf
• http://autowagon.it/userfiles/files/88021585047.pdf
• http://ippon.lv/uploads/File/vovikivof.pdf
• http://apartamentykunickiego.pl/architekci/public/upload/ckfinder/userfiles/files/lavozigijabejibor.pdf
• http://lobi.md/userfiles/file/75393463160.pdf
• http://ibnuaffan.com/ckfinder/userfiles/files/toperupu.pdf
• https://www.keystonecare.co.uk/wp-content/plugins/super-forms/uploads/php/files/5dc3f492a08dde11c138fe7255bb0a90/80365204518.pdf
• http://eca.or.th/ckfinder/userfiles/files/furugavomumefolevom.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• synerhu.ru
• libertyrealestate.in
• thucphamtruongxanh.com
• zamel2.pl
• digilit.ir
• lixupeng.com
• commissioncollectionlaw.com
• 7sate.com
• www.iqubz.com
• www.fishhabitatnetwork.com.au
• www.ezhealthcheck.com
• bomando.bomsolar.com
• grandviewgroupresort.com
• duszek-lasu.pl
• veraschwemmle.de
• lighthousemacau.com
• autowagon.it
• apartamentykunickiego.pl
• ibnuaffan.com
• www.keystonecare.co.uk
• www.w3.org
• purl.org
• ns.adobe.com
• fulzugaskozpont.hu
• ippon.lv

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report