MALICIOUS — fbf680f55121961c6194e05876e74692638c344e80b35332e3e125d86621aae2

MALICIOUS — fbf680f55121961c6194e05876e74692638c344e80b35332e3e125d86621aae2 is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: fbf680f55121961c6194e05876e74692638c344e80b35332e3e125d86621aae2
• SHA-1: 9359f4e7bfd231f7f6c2110203d79696772a7f91
• MD5: 0d5b8193c1291862fbd45b878f28b581
• ssdeep: 1536:FxYf4xlRG/WAvwGpYh9+zNeRJm5qrIIhRdp/kXFw8DrcM/WsMvfmSp2W8pO7yyCC:m4xlGD+9+zARJwqr7tp/kVJDrtMHmSpz
• TLSH: T12B3AD0F3209BDD5C374ADF43A5FB21A96089E7846252DD909088777CD0FCA7DAE00962
• Submitted as: fbf680f55121961c6194e05876e74692638c344e80b35332e3e125d86621aae2
• File type: pdf · Size: 97990 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://nomylo.ru/uplcv?utm_term=mejores+juegos+para+android+de+aventura, http://jujucuisine.com/userfiles/file/xinosetirusexusevog.pdf, https://pensiunea-escape.ro/ckfinder/userfiles/files/wugagoduza.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://nomylo.ru/uplcv?utm_term=mejores+juegos+para+android+de+aventura
• http://jujucuisine.com/userfiles/file/xinosetirusexusevog.pdf
• https://pensiunea-escape.ro/ckfinder/userfiles/files/wugagoduza.pdf
• http://apart1day.ru/file/8043874604.pdf
• http://cabinet-blin.fr/ressource/site-image/files/zetetalinaxadajowilenej.pdf
• https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/16136e4720eb16---puzojapobazivumusakizare.pdf
• http://penzion-u-zamku.cz/files/file/bubunajawawupubomojenag.pdf
• http://hermandadperdon.es/userfiles/file/maxugevogu.pdf
• http://prochem.vn/images/uploads/files/kuvubaxefutilebuwizemol.pdf
• http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/16133e0ad771db---95068351064.pdf
• http://spc1991.com/ckfinder/userfiles/files/bilazubanixisonumorop.pdf
• http://ajej.pretty-match.com/upload/files/labamejiwavexijuxo.pdf
• https://urbanlivin.lu/userfiles/files/rudexelijamow.pdf
• http://huichem.com/ckfinder/userfiles/files/sivotuzewubopijagowo.pdf
• https://doina.md/fckeditorfiles/file/molerod.pdf
• http://ominocoibaffi.it/userfiles/files/fubewuwulotapakezibibum.pdf
• https://mackbeks.com/files/file/gegidanidogijexukubomafu.pdf
• http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/16135460f833c4---98551691139.pdf
• http://xlpe.net/Images_upload/files/nemixuguritudoge.pdf
• https://omprintandpack.com/userfiles/file/51576377654.pdf
• http://szentdorottyapatika.hu/files/gonalojurizi.pdf
• https://storage-in-motion.com/wp-content/plugins/formcraft/file-upload/server/content/files/16137e01af22ca---27220430512.pdf
• http://fornacedelia.it/userfiles/files/37377176648.pdf
• http://www.jindatunnel.com/up_files/file/buxalonamarexejisutore.pdf
• https://www.zolmedis.lt/ckfinder/userfiles/files/64876121442.pdf

Embedded domains

• nomylo.ru
• jujucuisine.com
• apart1day.ru
• cabinet-blin.fr
• psychotherapie-dr-albrecht.de
• hermandadperdon.es
• antwerp-rentals.com
• spc1991.com
• ajej.pretty-match.com
• huichem.com
• ominocoibaffi.it
• mackbeks.com
• www.movingintofreedom.com
• xlpe.net
• omprintandpack.com
• storage-in-motion.com
• fornacedelia.it
• www.jindatunnel.com
• cooperadora.grupocreartel.com
• svenskafik.se
• www.w3.org
• purl.org
• ns.adobe.com
• pensiunea-escape.ro
• penzion-u-zamku.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report