MALICIOUS — tupobutux.pdf
MALICIOUS — tupobutux.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0e83080aa85dd1ea549937ea6292ac43c6362484a72be59e965f4a726fa5216d - SHA-1:
d905ff20328c9f7b8881acc9c97770561e44cc67 - MD5:
93d44f48a3140746f7a3eaad5378729f - ssdeep:
1536:+TcQaXHuhgt8WlVFwLmlMYjyRfwj+wWNANx10/ICr16fUNFAQWZhj5hmJoyvWCp4:8cQaHuhQ7lMB4awWN6x+UfUNW/jQoyYx - TLSH:
T1B039C0F71057EC9CBA8BDB0736EE12A45489EB887272DA900048B76CC57C9BE7F10561 - Submitted as: tupobutux.pdf
- File type: pdf · Size: 86866 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://4bx.pl/public/file/76606356423.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=young%27s+analytical+concordance+pdf+free+download, https://vjlabor.pitscovn.com/uploads/Upload/files/resiluzilopewurimidarox.pdf, http://dydlhx.com/upfiles/file///ditovorajopizowot.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://smidgel.ru/uplcv?utm_term=young%27s+analytical+concordance+pdf+free+download
- https://vjlabor.pitscovn.com/uploads/Upload/files/resiluzilopewurimidarox.pdf
- http://dydlhx.com/upfiles/file///ditovorajopizowot.pdf
- http://daeryuhealthcare.com/ckupload/files/16588079442.pdf
- http://4bx.pl/public/file/76606356423.pdf
- https://yuktogel.com/contents/files/nemozigenapebikatelaxi.pdf
- http://andersonlawdecorah.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/67794488252.pdf
- http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16139966b47d0f---pasebukuku.pdf
- http://lejuriste.ru/files/file/76984424028.pdf
- https://enerjimakine.com/tsrm1/img/userfiles/file/wobose.pdf
- http://nenorm.com/files/files/25166109989.pdf
- http://shinserviceodi.ru/wp-content/plugins/super-forms/uploads/php/files/6490a0266c100b3dbf5839943b67fea8/tarovazobiwasokiz.pdf
- https://leavereview.com/customerinterview/ckfinder/userfiles/files/tenule.pdf
- http://vietsaovang.com/uploads/userfiles/file/gebedajogozubaleraxota.pdf
- https://sitarasign.ir/data/file/vakogeruravuzolipojab.pdf
- http://personal.sut.ac.th/chantira/port/ckfinder/userfiles/files/wovuvurofesoronazap.pdf
- http://gramercy-grand.ru/files/file/72613370595.pdf
- http://szguilong.com/userfiles/files/rosijepagoferutusetozuwe.pdf
- https://md-bud.pl/szklo/photos/file/ferowamasa.pdf
- http://de-ko-gmbh.com/ckfinder/userfiles/files/38607678492.pdf
- http://deeringbayrealestate.com/userfiles/files/tanefibanedixobo.pdf
- http://gewoongroen.eu/app/webroot/files/userfiles/files/47436460306.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- smidgel.ru
- vjlabor.pitscovn.com
- dydlhx.com
- daeryuhealthcare.com
- 4bx.pl
- yuktogel.com
- andersonlawdecorah.com
- www.meglobalinc.co.za
- lejuriste.ru
- enerjimakine.com
- nenorm.com
- shinserviceodi.ru
- leavereview.com
- vietsaovang.com
- sitarasign.ir
- gramercy-grand.ru
- szguilong.com
- md-bud.pl
- de-ko-gmbh.com
- deeringbayrealestate.com
- gewoongroen.eu
- www.w3.org
- purl.org
- ns.adobe.com
- personal.sut.ac.th
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report