MALICIOUS — c1efe98eaf76206964f491c5c32e1b5f65f7c698d6d5c8668f0e7416849d2d8b

MALICIOUS — c1efe98eaf76206964f491c5c32e1b5f65f7c698d6d5c8668f0e7416849d2d8b is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: c1efe98eaf76206964f491c5c32e1b5f65f7c698d6d5c8668f0e7416849d2d8b
• SHA-1: 57bfbd54be870fb6a123a93784314561f8aa736b
• MD5: 42532e6b93f3f5b87ea8f953f9748b7a
• ssdeep: 1536:CWJckneAziATkDHlF8rYrl/9zu8R1Xh6iq+8y3a1fr7Ur+vix/12:RJckeIilarYxweXwiq+8y3adrIxM
• TLSH: T19F37D0F77567EC8D6D8F9F436DE50168205AC7987222D56414C8B62CC8BCABCBF20A01
• Submitted as: c1efe98eaf76206964f491c5c32e1b5f65f7c698d6d5c8668f0e7416849d2d8b
• File type: pdf · Size: 70790 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!42532E6B93F3
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://oniceh.ru/uplcv?utm_term=ccleaner+premium+apk, https://carthink.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609439acbe32b---romototezepidu.pdf, https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/fe587df37fd0b8058120d9a6d35f681c/moturazizosozagusupopofa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://oniceh.ru/uplcv?utm_term=ccleaner+premium+apk
• https://carthink.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609439acbe32b---romototezepidu.pdf
• https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/fe587df37fd0b8058120d9a6d35f681c/moturazizosozagusupopofa.pdf
• http://uniondeautoescuelas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c0d81a95be8---92642815062.pdf
• http://inewbus.com/wp-content/plugins/super-forms/uploads/php/files/e5usv899jfmb663ii88ts3u534/90981378861.pdf
• https://master-service.ro/images/file/pinemujekimefiseduge.pdf
• https://bxthirteen.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/dac64d7ee5c96b016faca528a3e79a15/ruzewagoreva.pdf
• https://p99.tw/pro_pic/files/wowopomawuvopuzixedu.pdf
• http://gentlemensquartersbarbershop.com/wp-content/plugins/super-forms/uploads/php/files/686d5db699ae975a6deeb725757768a6/jezelavatovonesifonulujow.pdf
• http://www.majoriscambio.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607ddb217c48f---89924402078.pdf
• http://allycatering.com/userfiles/98689080005.pdf
• http://amwordpress.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a804dbc3383---wizaviwebekubuwofajodadi.pdf
• http://polymer-optix.de/userfiles/file/6454488217.pdf
• https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/kucleb6ktvf9fn9729ml0ns6mo/kanedumodabivesomoj.pdf
• http://humanitool.ru/userfiles/file/kumamekopotamirugol.pdf
• http://thesnowmanicecream.com/ckfinder/userfiles/files/sikilawobalofaduvabutiw.pdf
• https://landlorddebtadvisory.com/wp-content/plugins/super-forms/uploads/php/files/fp4cniurf198tubc36oli6pvt1/newiragixujivikefuzaxixol.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• oniceh.ru
• carthink.org
• alphacleanwashing.com
• uniondeautoescuelas.com
• inewbus.com
• bxthirteen.wpengine.com
• p99.tw
• gentlemensquartersbarbershop.com
• www.majoriscambio.com.br
• allycatering.com
• amwordpress.org
• polymer-optix.de
• autosofortkauf.ch
• humanitool.ru
• thesnowmanicecream.com
• landlorddebtadvisory.com
• www.w3.org
• purl.org
• ns.adobe.com
• master-service.ro

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report