MALICIOUS — 41a0b6_e431be3be5c444efae901ab17beceec5.pdf

MALICIOUS — 41a0b6_e431be3be5c444efae901ab17beceec5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: e948d02ac75c136a398af03fa7f4b075173ba6f709e588e4110495a762e6e19f
• SHA-1: 2ebff93625b079d6a8d4860570fff86ddc742db2
• MD5: 86c23c447ca8c145c23788355818da88
• ssdeep: 1536:BcAYA2lODheSUE875IoAs6WLRxdpWlD4CcvlHzlxtSrGkRmDe4uVR9HMwVpRs:aAYA2lAh2EHc6WfSlDuHor03u1VV8
• TLSH: T1BB3BE1F31193CE4CBA8A67436DA6665950C6E2C93132A7A405C9F26CC8BD26DEF40F50
• Submitted as: 41a0b6_e431be3be5c444efae901ab17beceec5.pdf
• File type: pdf · Size: 103070 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://resalured.ru/wix?keyword=leviathan+extreme+unsynced+guide, http://diwavubodinaroj.myartsonline.com/hpi_savage_x_4.6_body.pdf, http://com-signto6.xyz/tagaxanexaguwodedasjbv5k.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://resalured.ru/wix?keyword=leviathan+extreme+unsynced+guide
• https://s3.amazonaws.com/sezewu/game_mobile_battleground_apkpure.pdf
• https://s3.amazonaws.com/fulazelof/teachers_day_paragraph_in_bengali.pdf
• http://diwavubodinaroj.myartsonline.com/hpi_savage_x_4.6_body.pdf
• http://com-signto6.xyz/tagaxanexaguwodedasjbv5k.pdf
• https://s3.amazonaws.com/tiniruru/65453971540.pdf
• http://4gusevshop.space/pufutuxubewuwixovefuziti5r0tg.pdf
• http://souve.me/xoxixufagej1js4.pdf
• https://s3.amazonaws.com/kozewuposoridil/vewafiwu.pdf
• http://idealica-italiaofficial.site/kolokasalusuwuketoginun52whe.pdf
• http://alteramaks.world/300547137680dsa7.pdf
• http://takipleskazan.org/fall_guys_knockout_race5mpzs.pdf
• http://ulekschool.online/superman_man_of_steel_java_gameyveq8.pdf
• http://lienforkid.com/milk_and_honey_by_rupi_kaurf4jig.pdf
• https://gamiwejejorar.weebly.com/uploads/1/3/4/4/134498461/6140719.pdf
• http://cg-designer.xyz/photo_gallery_and_screensavermnd2p.pdf
• https://s3.amazonaws.com/widiku/nice_guidelines_depression.pdf
• https://s3.amazonaws.com/tofizo/taxapuguwur.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• resalured.ru
• s3.amazonaws.com
• diwavubodinaroj.myartsonline.com
• com-signto6.xyz
• 4gusevshop.space
• souve.me
• idealica-italiaofficial.site
• alteramaks.world
• takipleskazan.org
• ulekschool.online
• lienforkid.com
• gamiwejejorar.weebly.com
• cg-designer.xyz
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report