MALICIOUS — faf3762d9e78a3612dc41589b9ef593d030637d483368fd83e7e3d565149fc74

MALICIOUS — faf3762d9e78a3612dc41589b9ef593d030637d483368fd83e7e3d565149fc74 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

SHA-256: faf3762d9e78a3612dc41589b9ef593d030637d483368fd83e7e3d565149fc74
SHA-1: 6d153dd55d16b617ed282373503aa4d1cb1deb1a
MD5: 46895029f1bae398e37c4ee4f535bd46
ssdeep: 1536:OHyC8Rr7H5vb/Uo3miqSXpsDqC9+G7Bp+Egwj0A2WStngv03ZWbpON4NF:Mszta4ZnE+GX+ETJUtn73bNW
TLSH: T1EA37C0F311ABDD4C33ABDF0719AB22586085CB845252EB9044C8BBACC57C67CBF24A51
Submitted as: faf3762d9e78a3612dc41589b9ef593d030637d483368fd83e7e3d565149fc74
File type: pdf · Size: 69859 bytes
Verdict: malicious (92/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: http://teleinwestor.com/userfiles/file/gokinajun.pdf, http://www.alfainstal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16133f45f32fd4---tuzubonobepovod.pdf, https://abrasco.org.br/ckfinder/userfiles/files/dunagudokinoganor.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=catch+tiles+magic+piano
http://teleinwestor.com/userfiles/file/gokinajun.pdf
http://www.alfainstal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16133f45f32fd4---tuzubonobepovod.pdf
https://abrasco.org.br/ckfinder/userfiles/files/dunagudokinoganor.pdf
https://igruppe.no/ckfinder/userfiles/files/80898959846.pdf
http://propertiesforrent.com/userfiles/file///54988377502.pdf
http://www.drivingschool-brno.cz/files/files/82519105236.pdf
https://ecohort.biz/userfiles/files/nafazufa.pdf
http://thaicockstar.com/ckfinder/userfiles/files/71811046468.pdf
http://madmojo.com/fckupload/file/xeriloka.pdf
http://ekotop.eu/userfiles/file/dovulipowi.pdf
http://ebus.cn/up_file/file/zoril.pdf
https://fsreloading.com/userfiles/files/41830624380.pdf
https://noihoithanhtuan.com/media/ftp/file/mozitopoje.pdf
http://sushiosushi.com/uploads/files/daves.pdf
http://vivaibonomo.it/userfiles/files/81858225068.pdf
http://classicalgardenornaments.com/uplds/file/15833318212.pdf
http://ondamarinarest.com/upload/files/monerewog.pdf
http://autobedrijvenindex.nl/images/uploads/petolisopuzoxunoz.pdf
https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/1612eaa5f1bc33---96087006379.pdf
http://rts-3.ru/upload/files/23982682229.pdf
http://cgpharma.in/cote_dor_import/admin/ckfinder/userfiles/files/89650730838.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

feedproxy.google.com
teleinwestor.com
www.alfainstal.pl
abrasco.org.br
igruppe.no
propertiesforrent.com
ecohort.biz
thaicockstar.com
madmojo.com
ekotop.eu
ebus.cn
fsreloading.com
noihoithanhtuan.com
sushiosushi.com
vivaibonomo.it
classicalgardenornaments.com
ondamarinarest.com
autobedrijvenindex.nl
www.gs-gleichmann.de
rts-3.ru
cgpharma.in
www.w3.org
purl.org
ns.adobe.com
www.drivingschool-brno.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report