MALICIOUS — ed70a6ca9f0c6ff1436934eb4c27f827dd50f1360fe62c92f83581a0db0b092c

MALICIOUS — ed70a6ca9f0c6ff1436934eb4c27f827dd50f1360fe62c92f83581a0db0b092c is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: ed70a6ca9f0c6ff1436934eb4c27f827dd50f1360fe62c92f83581a0db0b092c
• SHA-1: 9ef672b9cef0fb570c7ed0389c2e9041d911510f
• MD5: 9c7a9ddf90f3ddc5f76edb8efc5b4d64
• ssdeep: 1536:uIm674Rav2MLlZCin0Gi1TQJeCa4vWV4la58FMlW6pOu2VRELq:SZa+Ma100Cy4lauaWu2Pv
• TLSH: T10B37CFF32087DC4C7A8B9F43A5F740A9718AE38952B1EA604088B66CC47CDBE7F54951
• Submitted as: ed70a6ca9f0c6ff1436934eb4c27f827dd50f1360fe62c92f83581a0db0b092c
• File type: pdf · Size: 73655 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cructi.ru/uplcv?utm_term=walt+whitman+o+captain+my+captain+pdf, http://linker-apps.com/files/xupetuke.pdf, http://lasantitosrestaurant.com/userfiles/file/kabekokebewejidokev.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cructi.ru/uplcv?utm_term=walt+whitman+o+captain+my+captain+pdf
• http://linker-apps.com/files/xupetuke.pdf
• http://lasantitosrestaurant.com/userfiles/file/kabekokebewejidokev.pdf
• http://cuspsurgeons.com/userfiles/file/kugalobegomesijusugabu.pdf
• https://stancijanegrin.com/userfiles/file/41269650367.pdf
• http://silver.jo/ckfinder/blanc/files/zudefiwanurevitori.pdf
• http://szm.hu/userfiles/file/xetunalerudumuwi.pdf
• http://imhyuk.com/imhyukeditor/userfile/file/wuzapatuwomedenijugor.pdf
• http://ampletrekking.com/userfiles/file/repaxagobelabupinupora.pdf
• http://www.argentum.com/wp-content/plugins/super-forms/uploads/php/files/km533jv2p3jhj3npj4fuue9nv7/besenolorepidoga.pdf
• http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/161414dd950175---nuwejajifatax.pdf
• https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/28fca46733c77052220509b832707923/nakaveranasefax.pdf
• http://bharatdarshan.net/rgroup/ckfinder/userfiles/files/lawaxotesulolida.pdf
• http://www.elmundodelapiscina.com/ckfinder/userfiles/files/45006395795.pdf
• https://www.smartfutureexpo.com/ckfinder/userfiles/files/6449226982.pdf
• http://files.ibiza-ferien.de/file/52865563467.pdf
• http://sun-green.de/ckfinder/userfiles/files/24713867234.pdf
• http://studiorestagno.eu/userfiles/files/24981461441.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16139945c78403---13351296501.pdf
• http://tdbm.vn/upload/files/wuragulekogijerelufikaka.pdf
• http://vncdata.net/app/webroot/uploads/files/55518792566.pdf
• http://securitydirect.it/wp-content/plugins/super-forms/uploads/php/files/f51d00242470b0ebac2347ab6e66c3e8/geguxodivunu.pdf
• http://vallovin.it/userfiles/files/lajal.pdf
• http://kamerton.nl/clientfiles/kodevujowepofaj.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• cructi.ru
• linker-apps.com
• lasantitosrestaurant.com
• cuspsurgeons.com
• stancijanegrin.com
• imhyuk.com
• ampletrekking.com
• www.argentum.com
• gingerwooddesign.com
• givemeit.ru
• bharatdarshan.net
• www.elmundodelapiscina.com
• www.smartfutureexpo.com
• files.ibiza-ferien.de
• sun-green.de
• studiorestagno.eu
• www.1000ena.com
• vncdata.net
• securitydirect.it
• vallovin.it
• kamerton.nl
• www.w3.org
• purl.org
• ns.adobe.com
• silver.jo

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report