MALICIOUS — dab6a6414396417113f19603452714f41afa5a6c3cea44e0a228fc6f3588779c

MALICIOUS — dab6a6414396417113f19603452714f41afa5a6c3cea44e0a228fc6f3588779c is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: dab6a6414396417113f19603452714f41afa5a6c3cea44e0a228fc6f3588779c
• SHA-1: 88718ba299569bda0fda0e031880f97d216613c8
• MD5: 97ac3ed39232ded2786237a44703e62c
• ssdeep: 1536:TYgjco9ejlp1JUx4IkQcX03zaeGV7EcQFXP2WkNpOPLWBWGhzKTMaA:Ei/92C4LbAaL7EVlbPLWhhzz
• TLSH: T13737CFF371DBDD5C77879B0364A701A8A046F7882162EA6041C8BB2CD97C6BDFE04652
• Submitted as: dab6a6414396417113f19603452714f41afa5a6c3cea44e0a228fc6f3588779c
• File type: pdf · Size: 75569 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://mannaz.pl/userfiles1/file/pekelapefefawi.pdf, https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16143162838689---videtujefatuwedutuwivotaw.pdf, http://travelsi.ru/ckfinder/userfiles/files/10616228620.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/A3Ryygt5BCM/uplcv?utm_term=how+to+get+back+phone+contacts
• http://mannaz.pl/userfiles1/file/pekelapefefawi.pdf
• https://www.simplythebestevents.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16143162838689---videtujefatuwedutuwivotaw.pdf
• http://travelsi.ru/ckfinder/userfiles/files/10616228620.pdf
• http://kortennis.co.kr/B/ck/ckfinder/userfiles/files/lasopajibed.pdf
• http://wjvanderheidedienstverlening.nl/uploads/file/jibejawodaxazakika.pdf
• http://matsusushionline.com/uploads/files/2778911007.pdf
• http://sromedical.com/file_media/file_image/file/jazovenow.pdf
• http://materialdeestudo.top/userfiles/files/suwigabobed.pdf
• https://granitabrasive.com/editor_up/37048609382.pdf
• http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613a66d218877---luduzuzo.pdf
• https://estoniapools.com/contents/files/84854642250.pdf
• http://telek-trans.hu/editor_up/17376585115.pdf
• https://prospr.fr/ckfinder/userfiles/files/najatadogemugovanobakudu.pdf
• http://el-master.ru/userfiles/file/8690119798.pdf
• http://yucehukuk.com/resimler/files/pijifavorilorawep.pdf
• https://aznamaste.com/ckfinder/userfiles/files/71457824922.pdf
• http://www.qookspot.kitchen/wp-content/plugins/formcraft/file-upload/server/content/files/16142468039ccc---22750296473.pdf
• https://imagebuzz.net/ckfinder/userfiles/files/81682529658.pdf
• http://zoo-foto.cz/userfiles/file/94925831147.pdf
• http://stroynerud-sm.ru/wp-content/plugins/formcraft/file-upload/server/content/files/161329d7321836---39425411294.pdf
• http://biancoacolori.it/userfiles/files/29175738516.pdf
• https://medsplus.us/admin/images/file/18171458211.pdf
• http://westpakusa.com/phpsites/vertical_living/uploads/file/xezuporiwufene.pdf
• http://ballmillfactory.com/d/files/93398972663.pdf

Embedded domains

• feedproxy.google.com
• mannaz.pl
• www.simplythebestevents.ca
• travelsi.ru
• kortennis.co.kr
• wjvanderheidedienstverlening.nl
• matsusushionline.com
• sromedical.com
• materialdeestudo.top
• granitabrasive.com
• accurateverdicts.com
• estoniapools.com
• prospr.fr
• el-master.ru
• yucehukuk.com
• aznamaste.com
• imagebuzz.net
• stroynerud-sm.ru
• biancoacolori.it
• medsplus.us
• westpakusa.com
• ballmillfactory.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report