MALICIOUS — a5d6604a1c0b4755d61025acd67573a59bf46afa5311b567decbb9216b693ee4

MALICIOUS — a5d6604a1c0b4755d61025acd67573a59bf46afa5311b567decbb9216b693ee4 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: a5d6604a1c0b4755d61025acd67573a59bf46afa5311b567decbb9216b693ee4
• SHA-1: bab275b7dad9cd1ac38e25d04d834e11ab2f8b70
• MD5: 40063b70cebada886740c5411e16a200
• ssdeep: 1536:tEBSVki0JRy+0Y7ctD4BrkCf3EHHnXtQsrdG/7Z6bMEWAyyYorZ8bWQpOC6u+:G4VDWUCIDmr8HFru7Z6bMmrZ8GCI
• TLSH: T17939E1F350A7DD0DB29ACF432AAA11A6A496D3846172EA5041CDB33CC17CCFE6F14521
• Submitted as: a5d6604a1c0b4755d61025acd67573a59bf46afa5311b567decbb9216b693ee4
• File type: pdf · Size: 88284 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://repetitorebi.ge/userfiles/files/gogozoxuvel.pdf, https://skillmapmagazine.com/ckfinder/userfiles/files/14335825026.pdf, http://hzzxtl.com/UploadFile/file/20210903001027560.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=how+to+connect+my+android+phone+to+my+laptop+via+wifi
• https://repetitorebi.ge/userfiles/files/gogozoxuvel.pdf
• https://skillmapmagazine.com/ckfinder/userfiles/files/14335825026.pdf
• http://hzzxtl.com/UploadFile/file/20210903001027560.pdf
• http://www.cenlafilm.com/siteuploads/editorimg/file/19970585560.pdf
• http://mgbig.com/upload_fck/file/2021-9-4/20210904060217219008.pdf
• https://chezgregoire.fr/userfiles/23136351664.pdf
• http://thebankcardservice.com/uploads/files/33035707839.pdf
• http://hongdacable.com/d/files/xotutewumera.pdf
• http://boathousebrokerage.com/userfiles/file/vupazoloniko.pdf
• http://kolbiko.com/images/uploads/file/wejesifuxefisudoboletiku.pdf
• http://bbhshipyard.com/userfiles/file/68269647144.pdf
• http://tlumacz-bialystok.pl/pliki/file/54506790173.pdf
• http://keralastatetailorsassociation.com/userfiles/file/mojemalus.pdf
• https://www.auto-ecole-acm.com/ckfinder/userfiles/files/49990032192.pdf
• http://apisicul.com/userfiles/files/vosavelelekotiba.pdf
• https://www.gurgy.net/ckfinder/userfiles/files/19591950939.pdf
• https://matratva.in/userfiles/file/61905542733.pdf
• https://inprovitvenezuela.com/ckfinder/userfiles/files/76449025901.pdf
• http://exms.fr/sites/default/files/file/kojexekazujozexogib.pdf
• http://duocthientam.com/uploads/ckfinder/files/40293771816.pdf
• http://interfacetravels.com/app/webroot/js/ckfinder/userfiles/files/99585088108.pdf
• http://aptekadc.pl/userfiles/userfile/2175134549.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• feedproxy.google.com
• skillmapmagazine.com
• hzzxtl.com
• www.cenlafilm.com
• mgbig.com
• chezgregoire.fr
• thebankcardservice.com
• hongdacable.com
• boathousebrokerage.com
• kolbiko.com
• bbhshipyard.com
• tlumacz-bialystok.pl
• keralastatetailorsassociation.com
• www.auto-ecole-acm.com
• apisicul.com
• www.gurgy.net
• matratva.in
• inprovitvenezuela.com
• exms.fr
• duocthientam.com
• interfacetravels.com
• aptekadc.pl
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report