MALICIOUS — b0019688c7eb67d162d91767f9de53e661c54891b534a2eab4f7ae79ca5a10f5

MALICIOUS — b0019688c7eb67d162d91767f9de53e661c54891b534a2eab4f7ae79ca5a10f5 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

SHA-256: b0019688c7eb67d162d91767f9de53e661c54891b534a2eab4f7ae79ca5a10f5
SHA-1: 50fdcaa2798129deb8f4aab20db86e47e718f6c8
MD5: 9031efd71d64cb50bf2ee97953ffa99d
ssdeep: 1536:cylAGcqxtjdDBuQNwafrK7wVkUZ/sEFkr6WypOlZWx/SN4Pn2yIWCNnENEk8Viq2:plhxrDwKwoFVDRsEFkLl+/SN4P2yKnEX
TLSH: T1D03ACFF362EBCD4C66D69B4769FA0154A049DBC82172EE64508C7A6CC43C9BDBF04A60
Submitted as: b0019688c7eb67d162d91767f9de53e661c54891b534a2eab4f7ae79ca5a10f5
File type: pdf · Size: 95835 bytes
Verdict: malicious (92/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://quangcaowebsite.xemlaco.com/uploads/files/80453458899.pdf, http://tandprotheses.com/ckfinder/userfiles/files/65444952098.pdf, http://bilateralmatters.org/userfiles/file/bevataguximurufujaluku.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=room+database+singleton+kotlin
https://quangcaowebsite.xemlaco.com/uploads/files/80453458899.pdf
http://tandprotheses.com/ckfinder/userfiles/files/65444952098.pdf
http://bilateralmatters.org/userfiles/file/bevataguximurufujaluku.pdf
http://baldonimarcostudio.eu/userfiles/files/13874592333.pdf
https://santehsevast.ru/userfiles/files/95087543321.pdf
http://chinamakina.com/userfiles/file/vupodulilofavurevogolav.pdf
http://novosib-sport.ru/ckfinder/userfiles/files/tobozijumezi.pdf
http://anhuizhkj.com/upload_fck/file/2021-9-4/20210904112946678353.pdf
http://medtravel.lv/images/hand_uploaded/files/larero.pdf
http://tunesistudio.eu/userfiles/files/barinibapozafamenezosimi.pdf
http://tt-ural.su/admin/ckfinder/userfiles/files/gitilopatidu.pdf
https://handientu.vn/userfiles/file/26579202983.pdf
https://rakowka.pl/userfiles/file/98776322157.pdf
https://bccphil.paramedix.biz/uploadfiles/file/96499961719.pdf
https://protradingindia.net/userfiles/file/27123552409.pdf
http://techbis.pl/files/file/11843345654.pdf
https://masukpt1.com/contents/files/26372053051.pdf
https://cr2tek.com/userfiles/Proj_Name/files/28609875376.pdf
http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/0b81d775d55e38880b27f990e05ae0a6/20821698436.pdf
http://soloparamideco.com/js/new/fckeditor/userfiles/file/61723924071.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

feedproxy.google.com
quangcaowebsite.xemlaco.com
tandprotheses.com
bilateralmatters.org
baldonimarcostudio.eu
santehsevast.ru
chinamakina.com
novosib-sport.ru
anhuizhkj.com
tunesistudio.eu
tt-ural.su
rakowka.pl
bccphil.paramedix.biz
protradingindia.net
techbis.pl
masukpt1.com
cr2tek.com
chagatea.ru
soloparamideco.com
www.w3.org
purl.org
ns.adobe.com
medtravel.lv
handientu.vn

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report