MALICIOUS — 74782225153.pdf

MALICIOUS — 74782225153.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: a8f2db08a08bb2cd38ba606d17e0fe0f278dc60ad998b01316692d459a0b1615
• SHA-1: 4587a252b3be5c5474e28617c9040a5efb0f138a
• MD5: b5bfa883096475dca9e941a41e78c16c
• ssdeep: 1536:0KG8yXFvl9JareWOIw/zGz70QSUyy9tRBysmjWxrgJnZj0GNXWapOn82k/l:DHCFvTsretH/q3SUn9rtDr2nzNgnY
• TLSH: T1DB38D1F31197DD0D7A8BEB4358FD11AC609DE7885932EBE14088BA2C84BC97EBD14901
• Submitted as: 74782225153.pdf
• File type: pdf · Size: 82219 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://infrive.ru/uplcv?utm_term=https+%2F%2Fonline2pdf.com+pdf+to+word+converter, https://armagedonspedycja.pl/files/file/gomowadipugid.pdf, https://webupdate.ca/wp-content/plugins/super-forms/uploads/php/files/7lbpuje4hhll0uodi3pqq15jo9/fudobalawonekoritoj.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://infrive.ru/uplcv?utm_term=https+%2F%2Fonline2pdf.com+pdf+to+word+converter
• https://armagedonspedycja.pl/files/file/gomowadipugid.pdf
• https://webupdate.ca/wp-content/plugins/super-forms/uploads/php/files/7lbpuje4hhll0uodi3pqq15jo9/fudobalawonekoritoj.pdf
• http://modellszerviz.hu/userfiles/file/vuzutujixodawugaz.pdf
• http://stressmanagement-karriere.de/userfiles/file/nobosuxajat.pdf
• https://motionslam.com/wp-content/plugins/super-forms/uploads/php/files/dfefc364960c74c16a9f2fd2880b2c84/xuwukerif.pdf
• http://fogathajtohirek.hu/fckfiles/file/galaremotaworujomo.pdf
• http://gancza.pl/userfiles/file/zalifojamevuzuze.pdf
• https://www.nrlandscapes.co.uk/wp-content/plugins/super-forms/uploads/php/files/a08253012d55cbd96b0ea3c3e1bbcaf3/94682729059.pdf
• http://fpole.ru/sadm_files/46190530950.pdf
• https://chocoinmobiliario.com/wp-content/plugins/super-forms/uploads/php/files/0a6db916dda59224d03a8cfc3e77a277/fugonepupamap.pdf
• http://tipkeo.com/js/ckfinder/userfiles/files/96558612783.pdf
• https://www.sidertest.it/wp-content/plugins/formcraft/file-upload/server/content/files/160cbc2d26fd1c---10215197970.pdf
• https://arhometutor.com/userfiles/file/81967889391.pdf
• https://stijsr.com/userfiles/file/fifuvexaweliwakifuferuvis.pdf
• http://terezmisszio.eu/files/file/60640338020.pdf
• https://kassa-evotor.ru/wp-content/plugins/super-forms/uploads/php/files/a8cssnfpcbofgtc65fr3ohog3g/64231282124.pdf
• http://s-privod.ru/userfiles/file/befamin.pdf
• https://www.picmephotoboothhire.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160ae50efdae50---nopebinodaxufatu.pdf
• http://narnivet.com/userfiles/files/zujesikenawuwafoxupadid.pdf
• http://hanasushi6.com/uploads/files/gojobevinoresij.pdf
• http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a7f866ebfa5---38074309970.pdf
• https://puertoestereo.com/wp-content/plugins/super-forms/uploads/php/files/t6kc9cq1o1mi5mahqar17mu08s/69585672184.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• infrive.ru
• armagedonspedycja.pl
• webupdate.ca
• stressmanagement-karriere.de
• motionslam.com
• gancza.pl
• www.nrlandscapes.co.uk
• fpole.ru
• chocoinmobiliario.com
• tipkeo.com
• www.sidertest.it
• arhometutor.com
• stijsr.com
• terezmisszio.eu
• kassa-evotor.ru
• s-privod.ru
• www.picmephotoboothhire.co.uk
• narnivet.com
• hanasushi6.com
• www.nationaalgolfcongres.nl
• puertoestereo.com
• online2pdf.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report