MALICIOUS — fevujep.pdf
MALICIOUS — fevujep.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
10d166e07259b976481672a1685e28c46a4dac5b99669e1fc80c245e25700f09 - SHA-1:
b97fdbe7abe2b8edb9ef7be219c49717cabcad18 - MD5:
7d5bbb9543f922ea27cf5c1c7a8bc93d - ssdeep:
1536:GLVhGLzpg/AEwB307mx38xn1Fo30GoD2RMBAWxV+xw7Y6W8pO+pY7:8i9sAEW3kxn1OHoD2iBZV+/l+i - TLSH:
T17538C0F311AFED4C775A9B03BAA7206DA145DB886122DB5041C8766CD0BC7FDBA14A10 - Submitted as: fevujep.pdf
- File type: pdf · Size: 83903 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613360504c173---1716833089.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://laborke.ru/uplcv?utm_term=nascar+heat+3+apk, https://makanbanyak.net/contents/files/jebinu.pdf, http://matsonconstruction.net/userfiles/file/bawopo.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://laborke.ru/uplcv?utm_term=nascar+heat+3+apk
- https://makanbanyak.net/contents/files/jebinu.pdf
- http://matsonconstruction.net/userfiles/file/bawopo.pdf
- https://www.posluh.hr/ckfinder/userfiles/files/jepale.pdf
- http://gro-felix.si/uploads/81860854279.pdf
- http://jumpinfit.it/userfiles/files/gesegilevukajadame.pdf
- http://smolensk-bakaleya.ru/userfiles/file/64285928993.pdf
- https://araprinter.com/ckfinder/userfiles/files/juxonifixasafiti.pdf
- http://noavarservice.com/ckfinder/userfiles/files/33466122218.pdf
- http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613360504c173---1716833089.pdf
- http://dlzhrjd.com/images/uploadfile/files/dekopabikoxiti.pdf
- http://gamax-motor.cz/data/dokumenty/1505914850.pdf
- http://jnejendomsdrift.dk/userfiles/file/motoxafarixuvuramezoxub.pdf
- http://mabifitness.it/userfiles/files/dezonex.pdf
- http://hyundaiokla.com/uploads/files/komizakelutasusefap.pdf
- http://ks4073.com/file_media/file_image/file/zobusalapukevetan.pdf
- https://www.tocbirsen.org.tr/ckfinder/userfiles/files/marelu.pdf
- http://polipack.ru/content/file/giguwixukas.pdf
- https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/b12ecead72428db92e2e75fc5c8b65ca/nofagura.pdf
- http://duetsepolno.pl/userfiles/file/jeduzorodozabopej.pdf
- http://shouce-image.kuchuancdn.com/Public/resource/files/38411430280.pdf
- https://dalba.net/other_files/File/vewazufixukat.pdf
- http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16134df3e05b20---46775335260.pdf
- http://nieruchomosci-swidnica.pl/userfiles/file/46899008225.pdf
- http://chetaomaynganhnhua.com/uploads/files/38039449249.pdf
Embedded domains
- laborke.ru
- makanbanyak.net
- matsonconstruction.net
- jumpinfit.it
- smolensk-bakaleya.ru
- araprinter.com
- noavarservice.com
- joshuadacosta.com
- dlzhrjd.com
- mabifitness.it
- hyundaiokla.com
- ks4073.com
- polipack.ru
- donnasalon.ru
- duetsepolno.pl
- shouce-image.kuchuancdn.com
- dalba.net
- mijneigenlift.nl
- nieruchomosci-swidnica.pl
- chetaomaynganhnhua.com
- ewastexperts.com
- fasaac.org
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report