MALICIOUS — 160b19c58dd704---xufaneromujawotenu.pdf

MALICIOUS — 160b19c58dd704---xufaneromujawotenu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: a732d16f0f22f8d30809fb681ea1ca6ce458a6f3ea94fb4adf0c3398b21afe11
• SHA-1: bbace449e4167b69aa97898c2d9520cdcf5133b5
• MD5: bc20b75a763499495d65b108c8a6247b
• ssdeep: 1536:TjkggS7Ve9QgL2ykllny0Vjrj5TFTV+Wc6kNpMNu89dlEfBJMQ7:T4kbgL4A0p5TFcWc6kTMH9OBJl
• TLSH: T12437DFF7A2D3CE4CBA8BAF1769A3101C604AD5892071E7E54484FA6CC86C3ADBD01661
• Submitted as: 160b19c58dd704---xufaneromujawotenu.pdf
• File type: pdf · Size: 71830 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!BC20B75A7634
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/397cddb1d3c51ab4f0addb92a2123a6a/63724643453.pdf, http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/160b00e9e72996---49857314680.pdf, http://accessoriesunlimitedinc.net/catalog/file/zubukuj.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=where+is+allen+brothers+located
• https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/397cddb1d3c51ab4f0addb92a2123a6a/63724643453.pdf
• http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/160b00e9e72996---49857314680.pdf
• http://accessoriesunlimitedinc.net/catalog/file/zubukuj.pdf
• http://www.supercarrentalsofmiami.com/wp-content/plugins/formcraft/file-upload/server/content/files/160778a8c967af---2379113047.pdf
• https://www.aironface.com/wp-content/plugins/super-forms/uploads/php/files/7e74be2414fcfc0f393c17a880d917f6/foxagesikuja.pdf
• https://cruiseship.cruises/wp-content/plugins/super-forms/uploads/php/files/mjhbsb057qv9pnohnk4a1vp55v/45416531056.pdf
• http://styropapex.pl/userfiles/file/15078098043.pdf
• http://chronicles.ae/userfiles/files/24219831249.pdf
• http://bitite.lv/media/txt/122/file/mokafabikegubu.pdf
• https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/405emb9a6bncmeb240jbtikq6u/lonisesaxusek.pdf
• https://tucsonhomewindowtint.com/wp-content/plugins/super-forms/uploads/php/files/030b717fb262961b3a2a9e293a9d3d1a/94655209108.pdf
• https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/16098ec9c8e21e---desibafis.pdf
• https://ahi.com.ua/wp-content/plugins/super-forms/uploads/php/files/e63bf7ee57abf642749a8c6b0828bd34/41408693026.pdf
• http://aire-limpio.com/img/editor/file/36659017225.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• rjiminfra.com
• www.loockuniformes.com.br
• accessoriesunlimitedinc.net
• www.supercarrentalsofmiami.com
• www.aironface.com
• styropapex.pl
• sandalyecenneti.com
• tucsonhomewindowtint.com
• ohligschlaeger-berger.de
• ahi.com.ua
• aire-limpio.com
• www.w3.org
• purl.org
• ns.adobe.com
• cruiseship.cruises
• chronicles.ae
• bitite.lv

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report