MALICIOUS — e35ba59959ae498d0e7ae8d0ea0c712dea074d3261dd9e716d96929d883d52f1

MALICIOUS — e35ba59959ae498d0e7ae8d0ea0c712dea074d3261dd9e716d96929d883d52f1 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: e35ba59959ae498d0e7ae8d0ea0c712dea074d3261dd9e716d96929d883d52f1
• SHA-1: 486828be22dac3b436af00bf78e52905e218a46f
• MD5: 23c0de3f193bd65d187e7dd2a4cfd6ea
• ssdeep: 1536:9EL9w+gD/7tVbwVWcDfgre5DZzWkNpOPEiEAC9NPybWCXdbGZ1gSKL:jnztVbwVJg6zkPEiEzNynX0Z1m
• TLSH: T12A37BFF71097EE4C77576F0379E65169A08AD3842132FA9090C8BB6C897C6BDBF10950
• Submitted as: e35ba59959ae498d0e7ae8d0ea0c712dea074d3261dd9e716d96929d883d52f1
• File type: pdf · Size: 72509 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://huntic.ru/uplcv?utm_term=lawyers+manual+on+domestic+violence, https://virker-ikke.dk/files/dezerevomemubapazuvimo.pdf, http://poketomecam.com/uploads/files/gumukufa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://huntic.ru/uplcv?utm_term=lawyers+manual+on+domestic+violence
• https://virker-ikke.dk/files/dezerevomemubapazuvimo.pdf
• http://poketomecam.com/uploads/files/gumukufa.pdf
• http://kanizsakran.hu/userfiles/file/90584653769.pdf
• https://h016s5or78-du3.com/contents/files/73385037595.pdf
• https://promptcorporate.com/ckeditor/ckfinder/userfiles/files/22492098086.pdf
• http://distant-property.ru/fck_editor_files/files/sefepozajusotedovi.pdf
• http://alfavs.eu/userfiles/file/numexapokipagav.pdf
• http://humansharehouse.com/userData/board/file/pamibunuwaxojazo.pdf
• https://longislandinvestmentadvisors.com/nini/userfiles/file/41151907362.pdf
• http://theexplorerthai.com/userfiles/files/73372566127.pdf
• http://kaies.cn/upfiles/21091213512927441300g43a.pdf
• http://finalstage.biz/js/upload/files/16749161454.pdf
• http://rentaruedas.com/files/others/motasonepujizivitam.pdf
• http://kpdb.org/userfiles/files/87210872917.pdf
• http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1613db484de8cd---biwisitabamukosutafogine.pdf
• http://sarahscupcakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/16156f5eb0a82f---99568021264.pdf
• http://tks-forever.com/upload/2021/09/11/file/xizadekogugopazazu.pdf
• http://www.malagatour.es/ckfinder/userfiles/files/bafemozokomel.pdf
• http://contactfm.be/userfiles/files/81351394544.pdf
• http://polins.org/public/userfiles/file/zifivelojonilusenafakuk.pdf
• http://bingsu.ir/cache/fck_files/file/77615262096.pdf
• https://adeptos.clevercloud.pt/images/items/files/wirebaduduxipenimube.pdf
• http://keralabiblesociety.com/fck_uploads/file/20325434593.pdf
• http://korea-seals.com/ckfinder/userfiles/files/bezetinozimirokunanetogi.pdf

Embedded domains

• huntic.ru
• poketomecam.com
• h016s5or78-du3.com
• promptcorporate.com
• distant-property.ru
• alfavs.eu
• humansharehouse.com
• longislandinvestmentadvisors.com
• theexplorerthai.com
• kaies.cn
• finalstage.biz
• rentaruedas.com
• kpdb.org
• sarahscupcakery.com
• tks-forever.com
• www.malagatour.es
• contactfm.be
• polins.org
• bingsu.ir
• keralabiblesociety.com
• korea-seals.com
• www.w3.org
• purl.org
• ns.adobe.com
• virker-ikke.dk

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report