MALICIOUS — 68300514327.pdf

MALICIOUS — 68300514327.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: e78eb74948d31e76c32998f787a405cd16fd3462e38457a69850dcca7d875a94
• SHA-1: 1a840b13f45f691631def30700a84d7236143417
• MD5: 71353c785bde3c1b520ad8aff5b0ee57
• ssdeep: 1536:0/o38pYQNsaAK3irUZov7uC+V4at0CWpXxuAGpcSCJ0CZWbpON2AKvz8s:4oM9Nt3irlDu/45xuLNK0CbNUX
• TLSH: T11937C0F3215BDD9C7287A70369FB04A8658EE7C45162EA88458C736CC4BC6BDAF14B10
• Submitted as: 68300514327.pdf
• File type: pdf · Size: 74259 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://nedvizhimost-v-sharm-el-sheikhe.ru/uploads/files/sorevusigazutivudutipuv.pdf, http://usaoxin.com/userfiles/2021-9/file/momebosigu.pdf, https://bhiringisamsankalimandir.org/ckfinder/userfiles/files/47172231892.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/A3Ryygt5BCM/uplcv?utm_term=dance+monkey+song+id
• http://nedvizhimost-v-sharm-el-sheikhe.ru/uploads/files/sorevusigazutivudutipuv.pdf
• http://usaoxin.com/userfiles/2021-9/file/momebosigu.pdf
• https://bhiringisamsankalimandir.org/ckfinder/userfiles/files/47172231892.pdf
• https://chowdhurytourism.com/ckfinder/userfiles/files/dofovivom.pdf
• https://shaplaconsulting.com/app/webroot/ckfinder/userfiles/files/53068271329.pdf
• http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/16139f6d88b934---94402887544.pdf
• http://jolanyee.com/upload/files/202109021246461163.pdf
• http://usaoxin.com/userfiles/2021-9/file/towufe.pdf
• http://ateliergermain.club/sites/default/files/file/fuxodowedixodenufu.pdf
• https://estidevelopers.com/wp-content/plugins/super-forms/uploads/php/files/9a9ecd655cd764e6d5cec5428de2cff9/sokele.pdf
• https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613e20ad77a04---38451306234.pdf
• http://vitccorp.com/uploads/userfiles/file/kubigegotalenagexu.pdf
• https://lerong.vn/wp-content/plugins/super-forms/uploads/php/files/7cc06ac1edcc1cea707e5283ae1cd2c5/61055665031.pdf
• https://www.ideaklinik.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/161353b9cc396d---36418766536.pdf
• https://marjoyunlar.com/calisma2/files/uploads/9400849967.pdf
• http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/161421a6a240e7---65323982507.pdf
• http://usatovl.ru/upload/fckeditorfile/mesigenigaredabiloxef.pdf
• https://slide-bearing.com/d/files/mijemakaxumagefesanabup.pdf
• https://www.southdownscellars.co.uk/ckfinder/userfiles/files/92321090140.pdf
• http://ingenermarket.ru/userfiles/kekubasifeweto.pdf
• https://thietbigas.net/media/files/10839163846.pdf
• https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/5b0d96c79b355db2fe56ce114d118de2/16901505284.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• feedproxy.google.com
• nedvizhimost-v-sharm-el-sheikhe.ru
• usaoxin.com
• bhiringisamsankalimandir.org
• chowdhurytourism.com
• shaplaconsulting.com
• aaexpansionjoint.com
• jolanyee.com
• ateliergermain.club
• estidevelopers.com
• www.fifatravels.com
• vitccorp.com
• marjoyunlar.com
• verkoop-je-wagen.be
• usatovl.ru
• slide-bearing.com
• www.southdownscellars.co.uk
• ingenermarket.ru
• thietbigas.net
• mymovingestimate.com
• www.w3.org
• purl.org
• ns.adobe.com
• lerong.vn
• www.ideaklinik.com.tr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report