MALICIOUS — 68905320537.pdf

MALICIOUS — 68905320537.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 52 detection engines flagged it.

Identification

• SHA-256: f86d86c092f9a523809dcdb041eb9303bc436522061e325c3ecd057951bc1ca9
• SHA-1: 56627df83ff91f7ef4a0001191e404e9995f0c59
• MD5: f4260d5a5d3c9e7de9b73e2bc12fc8f9
• ssdeep: 1536:5/YYxRNUdUHo8KoT5dx+I69WUO6Hvl9Yr/mD9WRoCpQtyhCCKJbZWApO6BQA:5A8oLoTJ+I6a6HvlKr/oHCuy8CKJA65
• TLSH: T11938D0F3219BEE8C7B4B970359E751A4744BE3886171EB90408CB6ACC1BC97DBE50A50
• Submitted as: 68905320537.pdf
• File type: pdf · Size: 82654 bytes
• Verdict: malicious (92/100)

Detections (4 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://grapevinewinerytrail.com/clients/876125/File/dixitixotutekuxel.pdf, http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f328014d60---84880325441.pdf, http://uci.ir/userfiles/file/55123344741.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=midea+split+air+conditioner+manual
• http://grapevinewinerytrail.com/clients/876125/File/dixitixotutekuxel.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f328014d60---84880325441.pdf
• http://uci.ir/userfiles/file/55123344741.pdf
• http://premiumresourcing.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611c26bb8326b---jepixonewebududaf.pdf
• http://sujitonweb.com/userfiles/files/91180242432.pdf
• https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/8d9c2867cf28cc8aa62acf94bbaaa162/14724895060.pdf
• http://usagimatur.com/files/others/47492801530.pdf
• http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607991d257f16---99297406228.pdf
• https://www.marthatrotts.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16071960669c57---gibomitarobaron.pdf
• https://a1-recruitment.fr/v2011/Files/fck_upload/file/14113964545.pdf
• https://led7.ru/file/nukezosanarujokufina.pdf
• http://grappin-annat-como.com/userfiles/grappin-annat-como.com/file/lorawawuwotigukedawajij.pdf
• https://www.tyrtaios.gr/ckfinder/userfiles/files/82360640503.pdf
• http://aedelsur.com/contenido/files/12265280381.pdf
• http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/iscuigsv4oq71onokpcsft3kl2/nexonaraninobax.pdf
• https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/aac48fa61e5b953028bdef55c424d759/morarenumazekulejili.pdf
• https://mudraconsultancy.com/uploads/files/dorodujokuwut.pdf
• http://theopenhouseclub.com/wp-content/plugins/super-forms/uploads/php/files/d7c7917c250462b9e521907cf734d539/24532317767.pdf
• http://jr.ac.th/ckfinder/userfiles/files/38943645781.pdf
• https://carthink.org/wp-content/plugins/formcraft/file-upload/server/content/files/1610a44c1e9243---66806292500.pdf
• http://jnafarms.com/clients/864068/File/xilamasinif.pdf
• http://nacyc.jp/Upload/file/84390763851.pdf
• http://alituncer.com/userfiles/file/dojanafasi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• feedproxy.google.com
• grapevinewinerytrail.com
• www.1000ena.com
• uci.ir
• premiumresourcing.com
• sujitonweb.com
• whitelightdesign.com
• usagimatur.com
• joshuadacosta.com
• www.marthatrotts.ca
• a1-recruitment.fr
• led7.ru
• grappin-annat-como.com
• aedelsur.com
• vdbergelectro.nl
• mudraconsultancy.com
• theopenhouseclub.com
• carthink.org
• jnafarms.com
• nacyc.jp
• alituncer.com
• www.w3.org
• purl.org
• ns.adobe.com
• www.tyrtaios.gr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report