MALICIOUS — 202109071202155862.pdf

MALICIOUS — 202109071202155862.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 963d31a75704a1c2039930f69cbba0de6bb4bb59fe5370e63e18f4876e3bc71a
• SHA-1: 338638fb25cbfdbbcb67188f3fbb409640190ceb
• MD5: 19567f7563ab0fa302e72dae9c85b567
• ssdeep: 3072:TGEpWO9wB+4FNTm1vELL8+UOKWfpa/S/9L:HprwBfDK548b5SF
• TLSH: T1733CF1F3229BCC9CB7479F036AA911A87485D7857273FB501588B52CD1BC6BCBE00562
• Submitted as: 202109071202155862.pdf
• File type: pdf · Size: 118288 bytes
• Verdict: malicious (96/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://queure.ru/uplcv?utm_term=jurisprudence+pdf+free+download, https://www.ideaklinikankara.com/wp-content/plugins/formcraft/file-upload/server/content/files/160746753c2f85---883072707.pdf, https://diversified-nj.com/wp-content/plugins/super-forms/uploads/php/files/e20655694b990f9b46cb5f6d23561630/54379279436.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://queure.ru/uplcv?utm_term=jurisprudence+pdf+free+download
• https://www.ideaklinikankara.com/wp-content/plugins/formcraft/file-upload/server/content/files/160746753c2f85---883072707.pdf
• https://diversified-nj.com/wp-content/plugins/super-forms/uploads/php/files/e20655694b990f9b46cb5f6d23561630/54379279436.pdf
• https://parklanehotel.asia/userfiles/file/1868430399.pdf
• http://wuxihemei.com/ckfinder/userfiles/files/20210629_104305.pdf
• http://eperon-kochersberg.com/img_db/mosolagivo.pdf
• http://baigeleather.com/userfiles/file/25193678632.pdf
• https://tyko.pl/userfiles/file/todeba.pdf
• http://iwishop.hu/file/21244736676.pdf
• https://devcons.org/uploads/userfiles/files/89491693453.pdf
• https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/19f6e58657c220611b0a22f082729f32/nikosabov.pdf
• http://caacoding.net/wp-content/plugins/formcraft/file-upload/server/content/files/160765c623cd72---xukajaladerizuxanibigi.pdf
• https://zohopinler.com/calisma2/files/uploads/fuxozamupazimugi.pdf
• http://51www.org/uploadfile/file/dc5d89c23136e8e892005165b3d51f2f.pdf
• http://inewbus.com/wp-content/plugins/super-forms/uploads/php/files/gfhgis6msf85vkdaj38q40gve0/dirulonalesixibobudo.pdf
• https://lightingsystemscol.com/wp-content/plugins/super-forms/uploads/php/files/dc742f0e414695e8df90607a41369d78/19907495405.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094d54187d47---90973353093.pdf
• http://meble-tk.pl/userfiles/file/76602056185.pdf
• https://wccia-vastu.com/wp-content/plugins/super-forms/uploads/php/files/5ec42660776d36036cea36db43ee925d/muximizoxudi.pdf
• http://esoftland.com/userfiles/file/85826290027.pdf
• https://nutricount.cz/UserFiles/File/winabobure.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• queure.ru
• www.ideaklinikankara.com
• diversified-nj.com
• parklanehotel.asia
• wuxihemei.com
• eperon-kochersberg.com
• baigeleather.com
• tyko.pl
• devcons.org
• web-sila.ru
• caacoding.net
• zohopinler.com
• 51www.org
• inewbus.com
• lightingsystemscol.com
• www.1000ena.com
• meble-tk.pl
• wccia-vastu.com
• esoftland.com
• www.w3.org
• purl.org
• ns.adobe.com
• iwishop.hu
• nutricount.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report