MALICIOUS — 32241794470.pdf

MALICIOUS — 32241794470.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: c892d9a7952a57e56b746752ddadefd6e206734d9aaee7e32d00001aeef38337
• SHA-1: 2b23e823b7e0baa4b351b4350c3269ccbb1a3fa0
• MD5: e36865235a47430a522d2d106241ba4a
• ssdeep: 1536:052SQf+owOgmKUSmK7rMSjwrmnr3wz7fdDjdZ/P+W6pOu2MGIWBeCwjNB3HNJ5uH:YQfdBKbV7gS5nz8fXZ/ju29PAH3HhuH
• TLSH: T1BC3ADFF361A7DD4CB74B9F0375AA146C908EE7896222DB9010C8776CC1BC6BDBE14A40
• Submitted as: 32241794470.pdf
• File type: pdf · Size: 94915 bytes
• Verdict: malicious (96/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=how+to+save+pdf+multiple+pages+per+sheet, http://princeverma.in/uploads/files/pojikelikemivat.pdf, http://lacasedescaraibes.fr/file/25396827503.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://garglob.ru/uplcv?utm_term=how+to+save+pdf+multiple+pages+per+sheet
• http://princeverma.in/uploads/files/pojikelikemivat.pdf
• http://lacasedescaraibes.fr/file/25396827503.pdf
• https://coloreverything.love/wp-content/plugins/super-forms/uploads/php/files/5cb4d4cc1a5ad678f08499d3fb723927/88374005112.pdf
• https://www.alignerco.ca/wp-content/plugins/super-forms/uploads/php/files/2ec1693e7c1487d0644eac69fc012134/bijezopom.pdf
• https://ludifrance.fr/userfiles/file/katubujogejalevapega.pdf
• http://lideparts.com/userfiles/file/1621284442.pdf
• https://wurstfargo.com/wp-content/plugins/super-forms/uploads/php/files/fa98523cf3207441360e5516bcdd850d/97277241866.pdf
• https://traveltokiev.com/wp-content/plugins/super-forms/uploads/php/files/6s05qtvtdj7r1rcudrn1sc89e6/52668775573.pdf
• http://upsshop.ru/ckfinder/userfiles/files/libapuleji.pdf
• https://mehreganimaging.com/images/upload/files/rifutu.pdf
• https://www.heainc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086f3b82029f---laluvuxavoruge.pdf
• https://ahi.com.ua/wp-content/plugins/super-forms/uploads/php/files/00cc2f7fa02ff927ea4888b0c5dd185d/90203421534.pdf
• http://www.magicapro.it/wp-content/plugins/formcraft/file-upload/server/content/files/160bfacaeb2991---wojebesiredipilibawizu.pdf
• https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160b3da662954b---52913351605.pdf
• http://ridendo.cz/files/file/16959931678.pdf
• https://championsforchildren.org/wp-content/plugins/super-forms/uploads/php/files/bbefa0c406be4c3545041fb0186da658/91388565387.pdf
• http://personnelstrategies.net/userfiles/file/99839714702.pdf
• https://artsketch.ru/wp-content/plugins/super-forms/uploads/php/files/9b32fbb2eb0b766e12b202c0def5e163/15963250180.pdf
• https://geneticapanama.com/userfiles/file/teledegusoxup.pdf
• http://kag.fr/userfiles/file/30811597054.pdf
• https://www.surajinformatics.com/wp-content/plugins/super-forms/uploads/php/files/5845f04a0b8aa4b9d68ef1fb9d4a854e/mugowemurasemexamigozove.pdf
• http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160c2c11a1c8e3---fubivosumowoduxove.pdf
• http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160824a9275093---73873036097.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• garglob.ru
• princeverma.in
• lacasedescaraibes.fr
• www.alignerco.ca
• ludifrance.fr
• lideparts.com
• wurstfargo.com
• traveltokiev.com
• upsshop.ru
• mehreganimaging.com
• www.heainc.com
• ahi.com.ua
• www.magicapro.it
• rmissio.pl
• championsforchildren.org
• personnelstrategies.net
• artsketch.ru
• geneticapanama.com
• kag.fr
• www.surajinformatics.com
• remontnoedelo.ru
• www.kissdocs.com.au
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report