MALICIOUS — ba131662c544787a0ee3b7aac42d19b79f08c42ba82e16db69a395e5a0fbb396

MALICIOUS — ba131662c544787a0ee3b7aac42d19b79f08c42ba82e16db69a395e5a0fbb396 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: ba131662c544787a0ee3b7aac42d19b79f08c42ba82e16db69a395e5a0fbb396
• SHA-1: d7d4a3267a32fd7a6a8a6f41f308de7d45a64040
• MD5: 93c99e4fedd921cf0ffac4ebea30a3d0
• ssdeep: 3072:yn6IcNXdJ6f6eUDH5+fJhsYfU+FQ01PtIpyOXuFfKzMSrTJ7jx5ByZ:WpcNtPe0+hhsYfUH0X8y0ufArF7jxa
• TLSH: T13E3F02F3609BCE1C7297DF03A5E9612CE04AD6842136FF944144F9AC94B87BCAF156A0
• Submitted as: ba131662c544787a0ee3b7aac42d19b79f08c42ba82e16db69a395e5a0fbb396
• File type: pdf · Size: 156610 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071164590472---88083696988.pdf, http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/bc952f37b7d43ea22d70fd1d94255353/pawabivare.pdf, http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/jal7u0jn42rphn715i5ntpe6t5/zutawufabuberemipemusi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1KS0DP0cxss/uplcv?utm_term=burger+king+malaysia+menu+pdf+2021
• http://www.saraviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071164590472---88083696988.pdf
• http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/bc952f37b7d43ea22d70fd1d94255353/pawabivare.pdf
• http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/jal7u0jn42rphn715i5ntpe6t5/zutawufabuberemipemusi.pdf
• https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076f37a23491---lonudu.pdf
• https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d6972a2a4b---50765691674.pdf
• https://www.cfo-search.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a60f0b1e7f6---zapinosibamafugam.pdf
• https://yourlightingbrand.com/wp-content/plugins/super-forms/uploads/php/files/3d196ad7599cf45c3cb33ee56f539c11/roxudowa.pdf
• http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9b085dd924---38187361029.pdf
• http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/ommp93eacmmskchncgusode9k8/83644859259.pdf
• http://lexen.ca/userfiles/files/kedadaruk.pdf
• https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4997242cdd---xabemin.pdf
• http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16105d82354cdb---94321870096.pdf
• http://www.logomarcanet.com/userfiles/file/lexanu.pdf
• http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/1606d9fa19efe7---kolupipakosafufitap.pdf
• https://tmtteks.com/files/tagagusivewirabere.pdf
• https://viessmannboilers.ca/fck_upload/file/dalonimobokaxib.pdf
• http://www.masozilina.sk/ckfinder/userfiles/files/futazexufabalelo.pdf
• http://due.pt/js/ckfinder/userfiles/files/fusaxexipujef.pdf
• https://mygamedaysports.com/wp-content/plugins/super-forms/uploads/php/files/80b0e34689373045d6fff926231126bb/87307705561.pdf
• http://caribsplash.org/wp-content/plugins/formcraft/file-upload/server/content/files/160bf436a552fb---leran.pdf
• http://caigeshi.com/uploadfile/file/2021072809025773499.pdf
• http://industrialdevices.in/uploads/68534996533.pdf
• https://www.charityweiss.de/wp-content/plugins/formcraft/file-upload/server/content/files/160af17ecf394c---76326884828.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• feedproxy.google.com
• www.saraviation.com
• vasilii-orlov.fun
• english-island.pl
• www.acptechnologies.com
• www.sharpeningfactory.com
• www.cfo-search.com
• yourlightingbrand.com
• www.birapart.com
• dangkyidol.com
• lexen.ca
• benchmarktransitions.com
• hellnocancershow.com
• www.logomarcanet.com
• tmtteks.com
• viessmannboilers.ca
• mygamedaysports.com
• caribsplash.org
• caigeshi.com
• industrialdevices.in
• www.charityweiss.de
• www.w3.org
• purl.org
• ns.adobe.com
• www.farparts.cl

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report