MALICIOUS — 98714135376.pdf

MALICIOUS — 98714135376.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 99c4bfcd60ed6bc1d07049cf8763a77202e122e1c78296020fa987b4e1ac8073
• SHA-1: c2216fd57c99374b12dab5859f38384ddd950a67
• MD5: 62691f235329b2cb2307ad50d3484ba2
• ssdeep: 1536:9Yq/b+V3zabeAW8f6k5DveV0TrMt7P3sPNfzRwHN:aq0WbA8f6k56V0st7P8PNlY
• TLSH: T18F37D0F36197ED5CB9839B87A5A62829648CC38C2623E66040CC6B7DC97C3BE7D40D15
• Submitted as: 98714135376.pdf
• File type: pdf · Size: 75651 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!62691F235329
• Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://lozipotod.ru/strik?utm_term=john+deere+1025r+60+mower+deck+blades, http://wimifus.rf.gd/15938857942.pdf, http://zibelasavu.atwebpages.com/netajunosefevi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://lozipotod.ru/strik?utm_term=john+deere+1025r+60+mower+deck+blades
• https://s3.amazonaws.com/lejivugeleguwod/report_on_sports_day_in_your_school.pdf
• http://wimifus.rf.gd/15938857942.pdf
• https://s3.amazonaws.com/memexelu/greatsword_progression_guide_mhw.pdf
• https://s3.amazonaws.com/bulozor/electronic_library_resources.pdf
• http://zibelasavu.atwebpages.com/netajunosefevi.pdf
• http://lokemupuwife.rf.gd/firixudojiduxebomuxereg.pdf
• https://s3.amazonaws.com/gidibesuxi/73670872402.pdf
• http://jisijuvod.myartsonline.com/how_to_bar_a_soldier_from_reenlistment.pdf
• http://nariwunuzaw.scienceontheweb.net/memuxaxokolu.pdf
• https://s3.amazonaws.com/zedudo/the_secret_schizoid_ielts_reading_answer.pdf
• http://gemubanabugawa.mypressonline.com/how_to_unclog_print_head_epson.pdf
• http://gozenabuzixi.onlinewebshop.net/scorch_trials_free_stream.pdf
• https://s3.amazonaws.com/lawakux/59234076326.pdf
• https://s3.amazonaws.com/gisujubolidine/fuvisuvone.pdf
• https://s3.amazonaws.com/dedinavesute/afterlight_2_android_4pda.pdf
• http://sodahq.club/enron_smartest_guys_in_the_room_quotescw6lx.pdf
• http://artemk.ru/84661391486mztqx.pdf
• http://tagijonegularol.myartsonline.com/bash_script_variable_scope_function.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• lozipotod.ru
• s3.amazonaws.com
• zibelasavu.atwebpages.com
• jisijuvod.myartsonline.com
• nariwunuzaw.scienceontheweb.net
• gemubanabugawa.mypressonline.com
• gozenabuzixi.onlinewebshop.net
• sodahq.club
• artemk.ru
• tagijonegularol.myartsonline.com
• www.w3.org
• purl.org
• ns.adobe.com
• wimifus.rf.gd
• lokemupuwife.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report