MALICIOUS — 60039880142.pdf

MALICIOUS — 60039880142.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: b9e22c8ef9e4aab32d177e6d44941775a248eab103d0489f78559f3e9a6b5ca0
• SHA-1: 7059c3861f893edc8046ce30e0ec2beefb7d9f3e
• MD5: 3d1e938f963bc7457ab4429a5928eda7
• ssdeep: 1536:pSywvWYjrVIW7AQPrAP3vlZ9rb7WapOtQlJ4SWnPoqZit:4MYjh9Pr2tPb0tQlJ4x+
• TLSH: T1CD39C0F3604FDE8C3A579F43A9AA01DD604AE7842171EA6590CCB62CD5BC9FE6F00941
• Submitted as: 60039880142.pdf
• File type: pdf · Size: 84710 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://iamtimeshare.com/userfiles/file/31275332988.pdf, http://ilturismoinitalia.it/userfiles/files/pidatotajasezexozegun.pdf, https://www.azembay.com/wp-content/plugins/super-forms/uploads/php/files/o04a3epl9g849kqa5f2a3vt53b/wejuzezozigozutizekebe.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=nacha+rules+2017+pdf
• https://iamtimeshare.com/userfiles/file/31275332988.pdf
• http://ilturismoinitalia.it/userfiles/files/pidatotajasezexozegun.pdf
• https://www.azembay.com/wp-content/plugins/super-forms/uploads/php/files/o04a3epl9g849kqa5f2a3vt53b/wejuzezozigozutizekebe.pdf
• https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/160c6999a3aba8---68309684875.pdf
• http://auksozvynas.lt/userfiles/file/fupunizap.pdf
• https://vestol.bg/files/file/logunajupawimo.pdf
• https://www.certificagreen.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079002813854---57357595555.pdf
• https://evg-prague.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1609feccce9a7f---risebibelomolatik.pdf
• http://sushikyototogo.com/uploads/files/45536252245.pdf
• https://puertoestereo.com/wp-content/plugins/super-forms/uploads/php/files/l92dagihqak2tp7fcglnq3pmbn/jiges.pdf
• http://pokewaveanaheim.com/uploads/files/84808215919.pdf
• http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc9a67d30a---desakawe.pdf
• http://staropolski.net/Upload/file/finizugavurugotabodibami.pdf
• http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1c8d038df---77659697557.pdf
• http://www.gametimecatering.com/wp-content/plugins/formcraft/file-upload/server/content/files/16112baf8c9031---xotojolekuraxu.pdf
• https://airflow-skateboards.com/userfiles/files/lekaredeladeji.pdf
• http://dbjhockeytournament.com/clients/f/f9/f9ff496842c877cbb4522510b668f2a2/File/6607124899.pdf
• http://studioingegneriavaragnolo.com/userfiles/files/mifefipetezuwewazigi.pdf
• http://www.elitagida.com.tr/wp-content/plugins/super-forms/uploads/php/files/v5id5oapttbft5s3p42ecpd6r1/vixigimamet.pdf
• http://le-lemniscus-incandescent.fr/ckeditor/upload/files/77223660183.pdf
• http://mengnuanua.com/app/webroot/files/files/26688777928.pdf
• https://nestsearch.in/admin/uploads/file/xugifilopogu.pdf
• https://directprocessors.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c41cc45c069---50004104923.pdf
• https://irantruck.ir/data/file/243944162.pdf

Embedded domains

• feedproxy.google.com
• iamtimeshare.com
• ilturismoinitalia.it
• www.azembay.com
• husvagnsexpo.se
• www.certificagreen.com
• evg-prague.fr
• sushikyototogo.com
• puertoestereo.com
• pokewaveanaheim.com
• www.champcaregivers.com
• staropolski.net
• triumphtoday.org
• www.gametimecatering.com
• airflow-skateboards.com
• dbjhockeytournament.com
• studioingegneriavaragnolo.com
• le-lemniscus-incandescent.fr
• mengnuanua.com
• nestsearch.in
• directprocessors.com
• irantruck.ir
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report