MALICIOUS — db5d7e081ce6d2e8d668da3c4cd7384c11dab775dc5832254eac57e9f4624219

MALICIOUS — db5d7e081ce6d2e8d668da3c4cd7384c11dab775dc5832254eac57e9f4624219 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

SHA-256: db5d7e081ce6d2e8d668da3c4cd7384c11dab775dc5832254eac57e9f4624219
SHA-1: f05febcd7113606d8c2505c4369f4a2d5a3bfbda
MD5: 9a458cab3226665afb5d765e998f237c
ssdeep: 1536:pX5BLeAFIEjVx1N7S+G9XQ0mWCP8DpMBqWWwpOS9PW8ZR:hLe1EJx1pJGdkPypMMZS9u83
TLSH: T14038C0F3219BDD4C735A8B0379E64128618AD3CC6271FF9051C87AACC47CABDAE15950
Submitted as: db5d7e081ce6d2e8d668da3c4cd7384c11dab775dc5832254eac57e9f4624219
File type: pdf · Size: 82568 bytes
Verdict: malicious (92/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: http://viral-list-machine.com/ckfinder/userfiles/publics/files/2763029418.pdf, https://bellcera.60km.com/upload/files/52366223569.pdf, http://stelmart.ru/userfiles/file/rorupujedu.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=telegram+plus+apk+download
http://viral-list-machine.com/ckfinder/userfiles/publics/files/2763029418.pdf
https://bellcera.60km.com/upload/files/52366223569.pdf
http://stelmart.ru/userfiles/file/rorupujedu.pdf
http://interroadholland.nl/userfiles/file/dadowafifujivan.pdf
http://explosivedevices.ru/media/file/19776611773.pdf
https://aymsoft.us/aym_image/files/bowakoxikinofexox.pdf
http://tvkinter.com/file_media/file_image/file/pokobesifuwalekugixetok.pdf
https://cafesca.org/ckfinder/userfiles/files/64646434480.pdf
http://www.teeintact.com/admin/fckeditor/editor/filemanager/connectors/php/img/file/maguxunegivamorisatig.pdf
http://cetis156.neutronds.com/assets/js/ckfinder/userfiles/files/65578639676.pdf
http://blgjad.com/upload/files/kikasasijevizibotuv.pdf
https://skatrip.com/basefile/skatripcom/files/sozobevonagebimeda.pdf
https://istanajp.com/contents/files/78606702122.pdf
http://www.cddfct.com/up_files/file/wavev.pdf
http://retailcop.ca/files/81815430452.pdf
http://speednewslive24.com/assets/ckfinder/core/connector/php/uploads/files/21065227355.pdf
https://lombardpruszkow.pl/local/userfiles/file/15740840228.pdf
https://am-system.eu/ckfinder/userfiles/files/7492592647.pdf
http://studiovalecchi.it/userfiles/files/dewawajifod.pdf
http://kurier48.pl/files/userfiles/file/dibisikenibozozilu.pdf
http://plenerowe.kbo.pl/ckfinder/userfiles/files/limosenopawosenerot.pdf
http://studiotecnicodavico.eu/userfiles/files/gefojavijubeseruzukomenos.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

feedproxy.google.com
viral-list-machine.com
bellcera.60km.com
stelmart.ru
interroadholland.nl
explosivedevices.ru
aymsoft.us
tvkinter.com
cafesca.org
www.teeintact.com
cetis156.neutronds.com
blgjad.com
skatrip.com
istanajp.com
www.cddfct.com
retailcop.ca
speednewslive24.com
lombardpruszkow.pl
am-system.eu
studiovalecchi.it
kurier48.pl
plenerowe.kbo.pl
studiotecnicodavico.eu
www.w3.org
purl.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report