MALICIOUS — kojovarulujakerenaw.pdf

MALICIOUS — kojovarulujakerenaw.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 09ab6687323453ceaaa65980e722e87e40351df38d0a4a3c10ba1472d1699a60
• SHA-1: d9eb625c1dc6291dbddfda7e9b87c41c0fa9475a
• MD5: 496164ced3e425c6680a6296e9946420
• ssdeep: 1536:/Csac03j3/hHmbb7JCPyUyUbcKX+K+wT8ahTXWkNpOPaWMU+mI97ox0OWAWrFU:KbT3L/kbNCV7duDwcPl+9oTWAWu
• TLSH: T12538C0F32197DD4C7A47DF03B9FA01E9A49ED38C11B1AA604188B36C956C9BD7F24640
• Submitted as: kojovarulujakerenaw.pdf
• File type: pdf · Size: 77624 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cructi.ru/uplcv?utm_term=pma+6000+audio+panel+manual, https://paklya.su/design/img/upload/file/91642190672.pdf, http://ersatzmonitor.de/userfiles/file/24035754522.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cructi.ru/uplcv?utm_term=pma+6000+audio+panel+manual
• https://paklya.su/design/img/upload/file/91642190672.pdf
• http://ersatzmonitor.de/userfiles/file/24035754522.pdf
• http://davobio.com/upload/files/jutilix.pdf
• https://associazionemusicaviva.it/uploads/file/mikubu.pdf
• https://stpetejazz.com/wp-content/plugins/super-forms/uploads/php/files/fi0je13aj49dcgmcrmfc5ub9mv/siwotubanewus.pdf
• https://www.hauptsache.cc/wp-content/plugins/formcraft/file-upload/server/content/files/1607551c1f23dc---9590729220.pdf
• http://jucal.es/images/file/pufaduxajadefa.pdf
• http://synowka.pl/galeria/file/63756069990.pdf
• http://pxmonastery.org/CKEdit/upload/files/99421936497.pdf
• http://studiosantese.eu/userfiles/files/sepidujejukomanes.pdf
• http://www.santabriganti.org/admin/ckfinder/userfiles/files/95942274041.pdf
• http://ccapostolicchurch.org/clients/1/19/19d200bce63520a637954fb60b162b1a/File/23782478867.pdf
• https://medicentrumnz.eu/medicentrum/files/file/sewutubufoforez.pdf
• http://rufullthrottle.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609060660744b---naniterududide.pdf
• http://nw-line.ru/generic/uploaded/24821690895.pdf
• https://sunnyrosesschool.com/userfiles/file/nakizukamiji.pdf
• https://transpack-krumbach.de/_upload_bilder/_filemanager/file/84738482092.pdf
• https://thewentworthco.com/wp-content/plugins/super-forms/uploads/php/files/8s2alj3063h01bncm6p8i4lags/40086612037.pdf
• http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16121769976936---54064893525.pdf
• http://pujcovnanaradi-tvarozna.cz/userfiles/files/89589182105.pdf
• http://bydnjl.com/userfiles/files/musuwukesotevaxedeziteset.pdf
• http://ajarnveerapong.com/UserFiles/file/nasugajazabosujazoti.pdf
• https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/v016976umfn0sjikhr83upv1e1/52064360130.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• cructi.ru
• paklya.su
• ersatzmonitor.de
• davobio.com
• associazionemusicaviva.it
• stpetejazz.com
• www.hauptsache.cc
• jucal.es
• synowka.pl
• pxmonastery.org
• studiosantese.eu
• www.santabriganti.org
• ccapostolicchurch.org
• medicentrumnz.eu
• rufullthrottle.com
• nw-line.ru
• sunnyrosesschool.com
• transpack-krumbach.de
• thewentworthco.com
• principessavencanice.com
• bydnjl.com
• ajarnveerapong.com
• www.frontierexim.com
• www.w3.org
• purl.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report