MALICIOUS — 76649517664.pdf

MALICIOUS — 76649517664.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: ba66e39935f1e0206a1c9f8a3d8b8c843315f4ba965fabc7a64eef7cfd9cd55e
• SHA-1: eb5bb9ad303cb594cb7cf9607c085e32abeea401
• MD5: 9e397af0047c1509718445b5cd941d90
• ssdeep: 1536:G6Kn2i9UN65d2QVso+WLoD28EUR9lDF3YPymhGXFjftGUOKLNHW7x7A17nDDchcK:HS9v7VsoqvEUrwPyFXBcUOKNgpA17nPw
• TLSH: T14C39D0F32157DD4CBACBAF9365EA103D604BD2882175D6584088BBACD87C7BDBE24940
• Submitted as: 76649517664.pdf
• File type: pdf · Size: 86073 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!9E397AF0047C
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://pistant.ru/uplcv?utm_term=past+simple+irregular+verbs+exercises+pdf+with+answers, https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab2f5317d31---dupumumemebo.pdf, http://www.airportlimofortlauderdale.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606caf8114356---vaxulil.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://pistant.ru/uplcv?utm_term=past+simple+irregular+verbs+exercises+pdf+with+answers
• https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab2f5317d31---dupumumemebo.pdf
• http://www.airportlimofortlauderdale.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606caf8114356---vaxulil.pdf
• https://tlpnw.com/wp-content/plugins/super-forms/uploads/php/files/996f7b017e95a9bb3082054a152d9f7f/lipurefelemas.pdf
• https://www.azembay.com/wp-content/plugins/super-forms/uploads/php/files/dr63o943h2doavbi4iv2mqrup0/jazowiwaperugu.pdf
• https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/9c6f30ba6ee7726483b3bd9b564b8e20/46552260907.pdf
• https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/45440bc5eb6cb45222af36d39a3617f3/47248549040.pdf
• http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160727bcf848f4---wujoregipumi.pdf
• http://poltinik.ru/userfiles/file/mupijaganirasuj.pdf
• http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072b8d792ce5---42855472446.pdf
• http://baschin-heizung.com/meineBilderAlbertGrundschule/file/degowum.pdf
• http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606fe51015ff6---25714412334.pdf
• http://www.greenbriarpropmgmt.com/wp-content/plugins/super-forms/uploads/php/files/2845a32d819a8d3cb293e01155b175d9/lezomofobul.pdf
• http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/160808bab09e87---puvojuribexezimij.pdf
• http://duszek-lasu.pl/userfiles/file/pefizuruvuku.pdf
• http://www.webtony.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160949843aad2f---89998576090.pdf
• http://www.lightingandhvacexpo.com/wp-content/plugins/super-forms/uploads/php/files/ad9441f459f1cc27d233c7411725cf7b/mibudikumaw.pdf
• https://chameleoncoupons.com/adgprocessing/uploads/files/32144464469.pdf
• http://stylist.in.ua/wp-content/plugins/formcraft/file-upload/server/content/files/16079d8fae414a---ruwun.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• pistant.ru
• www.etbsupplies.com
• www.airportlimofortlauderdale.net
• tlpnw.com
• www.azembay.com
• mithermomix.com.mx
• www.hadlowsecurityshutters.com
• www.kinoimaging.nl
• poltinik.ru
• cedresarquitectura.com
• baschin-heizung.com
• kaufdeinauto.de
• www.greenbriarpropmgmt.com
• triumphtoday.org
• duszek-lasu.pl
• www.webtony.com.br
• www.lightingandhvacexpo.com
• chameleoncoupons.com
• stylist.in.ua
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report