MALICIOUS — 54790901394.pdf

MALICIOUS — 54790901394.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: afae54bb2cdfcb198eda2b8219d3312a62c44dcabf520af0298707fa8a6f28e6
• SHA-1: cd4431b50d44dbbcacfbf89ae43f16820ec456a9
• MD5: fa91937247b8719a3979a73a3fcf2614
• ssdeep: 1536:A15/bTW1KXDRSrDi5Xz+KlVdU4G/IWyj03W8pOG1bxM9XIWl3mU9cAL1:YRoKXDRSDQiK/d9GWjGlq9X1fcg
• TLSH: T1C839DFB75097DD8C76578F1329BF012874CAE7887576E6A08088BA7CC8BC5BD6F20542
• Submitted as: 54790901394.pdf
• File type: pdf · Size: 91210 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://catamma.ru/uplcv?utm_term=tirads+2019+pdf, http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4bb3b9a646---guwalufowad.pdf, https://118highschool.am/wp-content/plugins/super-forms/uploads/php/files/c3565c86c56be2d7e0b37f7be1b9e6eb/68309595147.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://catamma.ru/uplcv?utm_term=tirads+2019+pdf
• http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4bb3b9a646---guwalufowad.pdf
• https://118highschool.am/wp-content/plugins/super-forms/uploads/php/files/c3565c86c56be2d7e0b37f7be1b9e6eb/68309595147.pdf
• http://kd-council.com/upfile/files/nilino.pdf
• https://haysalon.com/public_html/userfiles/file/68314701676.pdf
• http://ladue69.com/clients/876446/File/tidanokakaxisafuxit.pdf
• http://biafrapol.pl/pliki/file/zadatenazuvokuv.pdf
• http://geteffective.biz/uploadfiles/file/rigesivivofeno.pdf
• https://www.frankcapassoandsons.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad8d7e88a04---68922686834.pdf
• https://officialbacknumber.com/editor_up/80456986741.pdf
• http://kovacsoltvaskerites.hu/images/file/jimafudav.pdf
• http://eperon-kochersberg.com/img_db/sixepamijawaj.pdf
• http://e1pl2.nazwa.pl/busy/fotki/file/271848697.pdf
• https://www.verpoort-bouw.be/wp-content/plugins/formcraft/file-upload/server/content/files/1606d1cbb2c483---rezige.pdf
• https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/55571b3de87ee6332a283b08f1ab4952/25202230990.pdf
• http://olympusflights.com/files/files/petom.pdf
• http://younewstoday.com/task/userimages/file/84760145733.pdf
• http://mgmkt.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a027a32461e---bovonakonovutobage.pdf
• http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/8736fea9297a6a51d4212bdd8d49d10d/98567976424.pdf
• http://campfirewtx.org/userfiles/file/rapupijoroduzewarutorunov.pdf
• https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac14ed17d44---49736996287.pdf
• http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/486aa8e825fe5900770b5b3ec297be6e/zisusavokiwavolilavimam.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/

Embedded domains

• catamma.ru
• parkwestresidences.com
• kd-council.com
• haysalon.com
• ladue69.com
• biafrapol.pl
• geteffective.biz
• www.frankcapassoandsons.com
• officialbacknumber.com
• eperon-kochersberg.com
• e1pl2.nazwa.pl
• www.verpoort-bouw.be
• www.hungryalex.com
• olympusflights.com
• younewstoday.com
• mgmkt.com.br
• www.neslihanonur.com
• campfirewtx.org
• www.fifatravels.com
• sad-azov.ru
• www.w3.org
• purl.org
• ns.adobe.com
• 118highschool.am
• kovacsoltvaskerites.hu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report