MALICIOUS — kujilebefisudediti.pdf
MALICIOUS — kujilebefisudediti.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0ca92ff4e486c7822f4dc8380b17de65c1c91352e2325ad48a193f37f8af3b7b - SHA-1:
c32b114f627ed413c73390e11df08ed2cc68b1f2 - MD5:
875a06de872bb3234b8c140e81e8ea1c - ssdeep:
1536:Amn1IzICXSTi9jgAx/3oam/suZOMR63cqSWxvzvTD1rA0F8TWapOntRB:ZlCiWFxvZmZtEMMvzva0Ocnl - TLSH:
T10439CFF36287CD8C7607EF436AEB129DA199D3892432EB91018C767CC07C67DAB14A51 - Submitted as: kujilebefisudediti.pdf
- File type: pdf · Size: 87823 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://bjqyms.com/filespath/files/20210904023528.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: http://snft.ro/media/file/dunesadunufugezerewidupim.pdf, http://budohurtsa.pl/userfiles/file/38609566914.pdf, http://sp2wronki.pl/fotki/fotki/file/17651571836.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=msn+email+server+settings+for+android
- http://snft.ro/media/file/dunesadunufugezerewidupim.pdf
- http://budohurtsa.pl/userfiles/file/38609566914.pdf
- http://sp2wronki.pl/fotki/fotki/file/17651571836.pdf
- https://monarchwinemerchants.com/wp-content/plugins/super-forms/uploads/php/files/27392a78658b551e4f8dbbbc92ad9c10/xerikeputunotadekebemipe.pdf
- http://www.halpellet.hu/userfiles/files/rupozujowimexuxogano.pdf
- http://bjqyms.com/filespath/files/20210904023528.pdf
- http://women-for-marriage.com/ckfinder/userfiles/files/65124047328.pdf
- https://infiniteprospects.com/FCKeditor/file/xolijufafotoli.pdf
- https://databaze-zdarma.cz/userfiles/files/buberutisodalem.pdf
- http://aire-limpio.com/img/editor/file/domoreritom.pdf
- http://busangh.com/attfile/fckimg/file///2021091263014_687816353.pdf
- https://www.tahitotfaluovodak.hu/ckfinder/userfiles/files/70790050202.pdf
- http://worldnaturalfood.com/image/upload/File/newegajuwikapobilezef.pdf
- https://burlingame.com/wysiwygfiles/file/lolujaj.pdf
- https://christianbelieversmatrimony.com/web/christiansbelieversmatrimony/photos/ckeditor/files/11261158165.pdf
- http://autohondl.cz/userfiles/file/44629860859.pdf
- http://inruho.ru/ckfinder/userfiles/files/tevotire.pdf
- http://jeanchapleau.com/userfiles/file/kozizupi.pdf
- http://sbs-group.co/userfiles/files/tejev.pdf
- https://ofly.om-digitalsolutions.cn/upload/files/59832022909.pdf
- http://www.phonefixcomo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613f80965430c---70331534747.pdf
- https://www.burit.net/wp-content/plugins/formcraft/file-upload/server/content/files/1613927c51fe26---tapenibutonadawiwa.pdf
- http://remont-etalon.ru/upload/files/bopilekodokufuvan.pdf
- https://darkoyunpin.com/calisma2/files/uploads/83183522943.pdf
Embedded domains
- feedproxy.google.com
- budohurtsa.pl
- sp2wronki.pl
- monarchwinemerchants.com
- bjqyms.com
- women-for-marriage.com
- infiniteprospects.com
- aire-limpio.com
- busangh.com
- worldnaturalfood.com
- burlingame.com
- christianbelieversmatrimony.com
- inruho.ru
- jeanchapleau.com
- sbs-group.co
- ofly.om-digitalsolutions.cn
- www.phonefixcomo.com
- www.burit.net
- remont-etalon.ru
- darkoyunpin.com
- igk-lilienthal.de
- nceed.kr
- anduong-nhatthanh.com
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report