MALICIOUS — zekisema.pdf

MALICIOUS — zekisema.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 109c1bdbf6ba030702f6dc28c294d1d9ee89fd7a78fc393ef0d86903cc0b683d
• SHA-1: c700a3a48ccd29cd53b19b03b16d7292925ae8c4
• MD5: a80c9a1da7ba03b765d9b86f07f96117
• ssdeep: 1536:vOrUe4eVrDvDJAQ5aMvh7i+eGnMXZW6pOu26W+sPTsqiIc0:mPrDDWQAuGJEMqu25TsdA
• TLSH: T18C38D0F32293DC4D370BCB036DEB6259A487D6CC2271EE515488B66CC53CABE2E14A50
• Submitted as: zekisema.pdf
• File type: pdf · Size: 83145 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://medvor.ru/uplcv?utm_term=romeo+juliet+book+pdf+download, https://maconlux.ovh/userfiles/files/pokeruk.pdf, http://www.hkimm.hk/_bin/ckfinder/userfiles/files/xikoloroniso.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://medvor.ru/uplcv?utm_term=romeo+juliet+book+pdf+download
• https://maconlux.ovh/userfiles/files/pokeruk.pdf
• http://www.hkimm.hk/_bin/ckfinder/userfiles/files/xikoloroniso.pdf
• http://fcraregistration.com/UploadedData/file/87531282600.pdf
• https://unitedpetexpress.unitedreloth.com/ckfinder/userfiles/files/judewaxagumebezofedolamus.pdf
• https://landtop.com/filespath/files/20210908230007.pdf
• http://studioingegneramato.com/userfiles/files/40163280550.pdf
• http://nenorm.com/files/files/15963141020.pdf
• https://supportsystemsvainc.com/home/ssvi/public_html/ckfinder/userfiles/files/73610341499.pdf
• http://metzlerranch.com/userimages/81464829731.pdf
• http://kitpaisal.com/mypicture/file/50813325516.pdf
• http://karimeh.com/public/userfiles/file/fejaxisujawibudule.pdf
• http://www.whirlpool-beachcomber.at/wp-content/plugins/formcraft/file-upload/server/content/files/16138a9cf67ad8---22720871033.pdf
• http://laxycoffee.com/upload/files/benozibeviwebefo.pdf
• http://hotelbelleepoque.bg/userfiles/file/39243514393.pdf
• https://minhgianggroup.vn/upload/files/pitomubolekexe.pdf
• http://razaviota.ir/basefile/razaviotair/files/jigipapa.pdf
• http://www.fd.ntou.edu.tw/ckfinder/userfiles/files/gitawesegegukubugovesav.pdf
• http://gianphoiduyloimodel.com/Images_upload/files/foderebesuzaxi.pdf
• https://actor-conseil.com/files/file/xitenotevijiwedu.pdf
• http://rancholasmonturaspremios.com/campannas/file/19059130730.pdf
• http://mgocsm.in/userfiles/file/woriwokuluputil.pdf
• http://vpecargo.com/userfiles/file/webakukamogeg.pdf
• http://www.cenlajobinator.com/siteuploads/editorimg/file/laminuwer.pdf
• http://tieuhocsongphuong.hoaiduc.edu.vn/ckfinder/userfiles/files/81905144902.pdf

Embedded domains

• medvor.ru
• www.hkimm.hk
• fcraregistration.com
• unitedpetexpress.unitedreloth.com
• landtop.com
• studioingegneramato.com
• nenorm.com
• supportsystemsvainc.com
• metzlerranch.com
• kitpaisal.com
• karimeh.com
• laxycoffee.com
• razaviota.ir
• www.fd.ntou.edu.tw
• gianphoiduyloimodel.com
• actor-conseil.com
• rancholasmonturaspremios.com
• mgocsm.in
• vpecargo.com
• www.cenlajobinator.com
• www.w3.org
• purl.org
• ns.adobe.com
• maconlux.ovh
• www.whirlpool-beachcomber.at

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report