MALICIOUS — 13617445569.pdf

MALICIOUS — 13617445569.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: a1a7519377287d2f360f48bd4dcd1ea4d3862bb0f29a98e05388dc04527e81dd
• SHA-1: 2a83601cf1d7927944df91bfbc3e7a75b93ab729
• MD5: 368374d5ad76a0dc74d47ada1e7ceec9
• ssdeep: 1536:HLJAnJrCgHVXni0B3Xv3UpNLqCXPH7PdTXQuMUJsZssGrkI24M1rc8TC1w0I0Cta:r0ggH/B3X/CNLFz5g5Ormt28Th0nCM
• TLSH: T1953BF1B372CBCD9C76CBDB13AED60429184DD7446235E5784844BBAC98B86BE3D00A74
• Submitted as: 13617445569.pdf
• File type: pdf · Size: 106607 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cructi.ru/uplcv?utm_term=features+of+romanticism+pdf, http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609ba59546c80---55589052368.pdf, https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/vq9ku6718nb9o3l44lr6d8c2l3/ladisa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cructi.ru/uplcv?utm_term=features+of+romanticism+pdf
• http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609ba59546c80---55589052368.pdf
• https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/vq9ku6718nb9o3l44lr6d8c2l3/ladisa.pdf
• https://tripleccompanies.com/wp-content/plugins/super-forms/uploads/php/files/a29e3893fb376b8363c20918a4c37c12/xitisumonupaseluzepoz.pdf
• http://www.atrium-tuiles.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c3f8d50c9e---69356769722.pdf
• https://portsidestrategies.com/wp-content/plugins/super-forms/uploads/php/files/23266df8a6e0b1aae36b6eec90cdfaf9/musinotiwivodoloxufinusa.pdf
• http://botosani.ro/img/uploads/file/59579508203.pdf
• https://zazilha.com.mx/wp-content/plugins/super-forms/uploads/php/files/e6ff46c96136ea0f583a3c2c43815366/64057160154.pdf
• https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/a0mrmuc68155q6958mpq3km613/lekarujufevar.pdf
• http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/16092a4fa82b83---67579785170.pdf
• https://oknoplus-omsk.ru/wp-content/plugins/super-forms/uploads/php/files/960be3c1d9bbac7a91021bb981b35345/23263229368.pdf
• https://www.swissfillon.com/wp-content/plugins/super-forms/uploads/php/files/8331db288c258613dca51d3abeaca324/5505666865.pdf
• http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609d51d355c8f---matamur.pdf
• https://fobiy.net/wp-content/plugins/super-forms/uploads/php/files/82016b46d2d4f9fc5e1825705906487b/24027539696.pdf
• http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16075dd9e4c013---gigivobifatonazawume.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cructi.ru
• jeugdopdewetenschapsagenda.nl
• hsegroup.ru
• tripleccompanies.com
• www.atrium-tuiles.com
• portsidestrategies.com
• zazilha.com.mx
• www.frontierexim.com
• www.fliesen-brill.de
• oknoplus-omsk.ru
• www.swissfillon.com
• fobiy.net
• www.dnevi-sekretarjev.eu
• www.w3.org
• purl.org
• ns.adobe.com
• botosani.ro
• www.playerclub.ro

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report