MALICIOUS — kidurevuzenebazem.pdf

MALICIOUS — kidurevuzenebazem.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 10ab79f1ad9c83ec631763372a41fa366eeca621768659bdc7d232bf7bcbc2d1
• SHA-1: 54c31d7da40b0a4bd27793dee325a274984d68d2
• MD5: 07f558b169de443d2261f9a9ab4aa0ec
• ssdeep: 1536:cO/4tffYnaYMF7EOfMtzC9OR6bfcFteemW7v1HPfou3XizFE0Ye1Xi:D4inFMOi8hFABW7vdftXMFOeA
• TLSH: T16636D1F7912BEDDCB5859363D596503D518BE6886232E2E408CCFABC84BC1BC2E50D54
• Submitted as: kidurevuzenebazem.pdf
• File type: pdf · Size: 68934 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!07F558B169DE
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://allycatering.com/userfiles/19564812334.pdf, http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/i5b59pp37ris3ql0eg0rc0c0ll/17234999057.pdf, http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606e0f9a5e228---mefesaj.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=full+album+audioslave
• http://allycatering.com/userfiles/19564812334.pdf
• http://www.tif.cn/wp-content/plugins/super-forms/uploads/php/files/i5b59pp37ris3ql0eg0rc0c0ll/17234999057.pdf
• http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606e0f9a5e228---mefesaj.pdf
• https://southtours.com/wp-content/plugins/super-forms/uploads/php/files/01maurta6ivisfg575k3ihl2n0/34965695181.pdf
• https://segurosjdd.com/wp-content/plugins/super-forms/uploads/php/files/pndfu5hkhv9npa7v65et7ghn72/dobufaximedazorewojawij.pdf
• https://frasertechno.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a9052d3e06---fezetipimivu.pdf
• http://kapelski.pl/userfiles/file/liwurobanel.pdf
• https://www.kiteschule-kiel.de/wp-content/plugins/formcraft/file-upload/server/content/files/16094167491cec---37752866663.pdf
• http://www.allatpatikapecs.hu/images/file/58118064702.pdf
• https://sharpspringwww.kinsta.cloud/wp-content/plugins/super-forms/uploads/php/files/55290cced7f2459b9ec844837083d6e7/xilij.pdf
• https://gz-topstar.com/wp-content/plugins/super-forms/uploads/php/files/8671830ae14055029f9a1cd4a55b2195/40921520802.pdf
• https://www.sacproblemleri.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c1b013d2c2---bejewadixotoguf.pdf
• http://conwaychristian.org/wp-content/plugins/formcraft/file-upload/server/content/files/16075ee47c1d7e---18689356451.pdf
• http://www.stockholmswingallstars.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080ba5a928b4---39008589568.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• allycatering.com
• www.tif.cn
• www.fliesen-brill.de
• southtours.com
• segurosjdd.com
• frasertechno.com
• kapelski.pl
• www.kiteschule-kiel.de
• sharpspringwww.kinsta.cloud
• gz-topstar.com
• www.sacproblemleri.com
• conwaychristian.org
• www.stockholmswingallstars.com
• www.w3.org
• purl.org
• ns.adobe.com
• www.allatpatikapecs.hu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report