MALICIOUS — 9b612bfb6981aa70363ae99128796bd33fcfca01627d4fc518aaa0df4e6bfbd0

MALICIOUS — 9b612bfb6981aa70363ae99128796bd33fcfca01627d4fc518aaa0df4e6bfbd0 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 9b612bfb6981aa70363ae99128796bd33fcfca01627d4fc518aaa0df4e6bfbd0
• SHA-1: 63938e73f98a345d8f07035b002cfb6d380ea49b
• MD5: f575630eebbddfb421ea79bba6dc7cc9
• ssdeep: 1536:wCQXqKY2akJop70n9O0sWfcxk5L74siwcTx0WkNpOP8uW6WBJwnKKHz0oXt:RQXlY2aOBn9O0sWbL0SsxpP8uW5wnKKB
• TLSH: T17A37C0F321E7DE4CB78F5B0369E62159E0DED6489172EAA04048777CC87C97EAB01A41
• Submitted as: 9b612bfb6981aa70363ae99128796bd33fcfca01627d4fc518aaa0df4e6bfbd0
• File type: pdf · Size: 71288 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://eco-translation.ca/upload/editor/file/metazugoli.pdf, https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1614cc5791a280---ziwuzewodovawu.pdf, https://swaarm.de/app/webroot/upload/files/20948831524.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=volley+image+request
• https://eco-translation.ca/upload/editor/file/metazugoli.pdf
• https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1614cc5791a280---ziwuzewodovawu.pdf
• https://swaarm.de/app/webroot/upload/files/20948831524.pdf
• http://dongtienlamnghiep.com/upload/file/70895243683.pdf
• http://behtarinekhodetbash.com/files/files/99650436235.pdf
• https://sanipro.ma/app/webroot/uploaderfiles/89294421089.pdf
• https://chorland-dining.com/webroot/editor-uploads/files/jusapenebubipefusazaweba.pdf
• http://gapp.fr/medias/files/ridebazesid.pdf
• http://aylabawadi.ae/userfiles/file/pagonolu.pdf
• https://fjordancv.info/wp-content/plugins/super-forms/uploads/php/files/a3752c44cc85158d9f4198703afc4569/dokavixegujuliru.pdf
• http://ji-tien.com/userfiles/file/sekusedukijumelapamadel.pdf
• https://szelvedojavitasmiskolc.hu/files/files/robipivi.pdf
• http://centromp.it/userfiles/files/23335704967.pdf
• http://scissortailfarms.com/wp-content/plugins/formcraft/file-upload/server/content/files/161380d810b4ad---xoketitebijol.pdf
• http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16150537d9d571---61556315016.pdf
• https://rafaellopezehijo.com/upload/files/tarazudosuvoti.pdf
• https://kheops-so.fr/ckfinder/userfiles/files/20048958069.pdf
• https://baconbites.com/wp-content/plugins/super-forms/uploads/php/files/h4mo6d87sht5603qgb8ve46iu4/bexodoxovozutexo.pdf
• http://www.victorian-manor.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1615341588a013---wuninufevumexinizi.pdf
• https://baoholaodong24.baohohoanglong.com/userfiles/file/pirogajon.pdf
• https://planet-pvc.com/upload/files/fipefumuzetijakerit.pdf
• https://ms02bet.com/contents/files/89898484492.pdf
• http://sbstroy53.ru/img/files/39282158245.pdf
• http://www.maoles.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614785e656358---52210528511.pdf

Embedded domains

• feedproxy.google.com
• eco-translation.ca
• fietenhaardenenkachels.nl
• swaarm.de
• dongtienlamnghiep.com
• behtarinekhodetbash.com
• chorland-dining.com
• gapp.fr
• fjordancv.info
• ji-tien.com
• centromp.it
• scissortailfarms.com
• bizwd.com
• rafaellopezehijo.com
• kheops-so.fr
• baconbites.com
• www.victorian-manor.co.za
• baoholaodong24.baohohoanglong.com
• planet-pvc.com
• ms02bet.com
• sbstroy53.ru
• www.maoles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report