MALICIOUS — 45694795736.pdf

MALICIOUS — 45694795736.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: abd24abc9887ac0530b6442ffdf597f6de254237ce9a948be4d74c13bbec39a9
• SHA-1: ac2422a7f9e451279ba1855b9d560c68870fd3ea
• MD5: 8d0931a075dbc6701cd68b9cbc376123
• ssdeep: 1536:A8RSdjSv3f9U9032U3n/rwQSZxuUpAm0B5OhRW3O3QC14BswWQpOC9dY:r8Sv3O03h3mpA1+rDCsfCs
• TLSH: T1103AD0F3505BDD4C7B876F436EFB12A8B04AC7481161EA91418C7A6C94AC47EBF10A22
• Submitted as: 45694795736.pdf
• File type: pdf · Size: 94159 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://accronline.com/userfiles/file/46961756238.pdf, http://alkanboya.com/files/file///fivisud.pdf, http://securitydirect.it/wp-content/plugins/super-forms/uploads/php/files/bb9580080657ee1503f58cc9b65825fd/23562469010.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/A3Ryygt5BCM/uplcv?utm_term=6rs+of+recycling
• http://accronline.com/userfiles/file/46961756238.pdf
• http://alkanboya.com/files/file///fivisud.pdf
• http://securitydirect.it/wp-content/plugins/super-forms/uploads/php/files/bb9580080657ee1503f58cc9b65825fd/23562469010.pdf
• https://www.clubmanizales.com.co/wp-content/plugins/formcraft/file-upload/server/content/files/160b37557d0e15---vibuzuvomitozan.pdf
• https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2ee82ebc1f---92120724327.pdf
• http://tuzvedo.hu/elemek/file/82217891225.pdf
• http://caribsplash.org/wp-content/plugins/formcraft/file-upload/server/content/files/160ccdfabe09a9---25550719385.pdf
• http://dansecyr.ca/pdf/file/64349640675.pdf
• https://motionslam.com/wp-content/plugins/super-forms/uploads/php/files/d4426fe75cbbf520b313aeedd0140bf4/lojadazesegisivisulad.pdf
• http://acecaalcoy.com/userfiles/file/gekinexafepavabetigof.pdf
• http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e9e294e3f9---tofinakomesobivifi.pdf
• https://landbondcorten.com/attachment/file/ac4d8f63b82b649d9ec21ab28d49dd02.pdf
• http://svaz-podnikani.cz/files/file/56024759599.pdf
• https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/e7dd72a1eaf61c81c786b3adaf031adc/xufeziwaguda.pdf
• https://www.teppiche-waschen-hamburg.de/wp-content/plugins/formcraft/file-upload/server/content/files/16089251470c33---95242595125.pdf
• http://tsg-vaganovskoe.ru/ckfinder/userfiles/files/68528983695.pdf
• https://nslogisticservice.com/userfiles/files/ziridunuvunubibag.pdf
• https://citytrafik.nu/images/file/29602238820.pdf
• http://ride.hu/images/uploads/files/30371064389.pdf
• https://tepihtrava.rs//files/funezib.pdf
• https://cihangirhotel.com/upload/ckfinder/files/ropuzenumitosezubaduxeb.pdf
• http://geoodwierty.pl/files/file/vixaminakufomujovos.pdf
• https://kachhiproperties.com/wp-content/plugins/super-forms/uploads/php/files/ajg5435stdtei423gtf4a88574/20311436347.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• feedproxy.google.com
• accronline.com
• alkanboya.com
• securitydirect.it
• www.clubmanizales.com.co
• nationalcardsolutions.com
• caribsplash.org
• dansecyr.ca
• motionslam.com
• acecaalcoy.com
• www.absolutecateringla.com
• landbondcorten.com
• amirep.com
• www.teppiche-waschen-hamburg.de
• tsg-vaganovskoe.ru
• nslogisticservice.com
• cihangirhotel.com
• geoodwierty.pl
• kachhiproperties.com
• www.w3.org
• purl.org
• ns.adobe.com
• tuzvedo.hu
• svaz-podnikani.cz
• citytrafik.nu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report