MALICIOUS — 12641406682.pdf

MALICIOUS — 12641406682.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: ffc74d85113c8ca60a53a6d87efe7b99022598015812a5439eb8430fa7ce7f1c
• SHA-1: cda3f3852a8aa6882799d36134cfa1afaf51e9fb
• MD5: 9f8f3cc009e71cd414bcabe49f1862de
• ssdeep: 1536:mDQ35rBC5dwxTDG7TPYApYkjUYcSjZ6W0q5wMiMlo1WspORvYnKK6:J35ATwxYTP2kjUYcSJ5Flo8Rgng
• TLSH: T1BD37CFF3308BCD9C73C79B0759BA156D758AD3485262EBA050887A7C84BC67D7F20A21
• Submitted as: 12641406682.pdf
• File type: pdf · Size: 76227 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://ketchas.ru/uplcv?utm_term=download+chrome+app+apk, http://versobrokers.eu/userfiles/files/56364902341.pdf, http://fcraregistration.com/UploadedData/file/78180952702.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ketchas.ru/uplcv?utm_term=download+chrome+app+apk
• http://versobrokers.eu/userfiles/files/56364902341.pdf
• http://fcraregistration.com/UploadedData/file/78180952702.pdf
• http://cokhihoangvinh.com/uploads/userfiles/file/satipakubaweka.pdf
• http://alatasfilms.gr/ILC/img/file/59382537405.pdf
• http://flemingdecal.com/uploads/assets/file/8755196632.pdf
• http://orthodoxvaidikasanghom.org/userfiles/file/fejafe.pdf
• http://boilerservis.ru/uploads/files/12420189471.pdf
• http://luxcottage.ru/stroykamen/userfiles/files/xokupub.pdf
• https://ximatinhdongnai.com/app/webroot/files/images/pages/files/pugogelolog.pdf
• http://dj-maily.com/uploads/pages/files/19572517447.pdf
• https://www.saltriot.com/wp-content/plugins/super-forms/uploads/php/files/44cada170e742860634d2ebffe797814/85028888992.pdf
• http://joyerialaplaza.com/ckfinder/userfiles/files/75496155350.pdf
• http://cargologicru.com/sadm_files/gemuzotekiso.pdf
• http://bagliodeimille.it/userfiles/files/45233067577.pdf
• http://stonebreaker.at/vulefotawumanemoze.pdf
• http://kimwendelldesign.com/ckfinder/userfiles/files/44477160000.pdf
• http://carrollcountylawyers.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/tikepab.pdf
• http://cheapneasytrafficschool.com/CheapNEasyTrafficSchool/pa/trainstation/uploads/image/file/25492535366.pdf
• http://www.fotografoeventimilano.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613980cfa1ea1---24164404939.pdf
• http://restauraceeverest.cz/userfiles/file/vatugivatekerumaxa.pdf
• https://rolcsi-bau.hu/userfiles/files/mubagiturag.pdf
• http://lasermedia.cn/userfiles/file/69444417535.pdf
• https://erdenet.mn/userfiles/file/mexemimixo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• ketchas.ru
• versobrokers.eu
• fcraregistration.com
• cokhihoangvinh.com
• flemingdecal.com
• orthodoxvaidikasanghom.org
• boilerservis.ru
• luxcottage.ru
• ximatinhdongnai.com
• dj-maily.com
• www.saltriot.com
• joyerialaplaza.com
• cargologicru.com
• bagliodeimille.it
• kimwendelldesign.com
• carrollcountylawyers.com
• cheapneasytrafficschool.com
• www.fotografoeventimilano.com
• lasermedia.cn
• www.w3.org
• purl.org
• ns.adobe.com
• alatasfilms.gr
• stonebreaker.at
• restauraceeverest.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report