MALICIOUS — wusosidirosirivode.pdf

MALICIOUS — wusosidirosirivode.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 11d5df67b0b56efb4217ef0e4fd07b20af2b3d6d3c8c850c833c5656e9e5c8c1
• SHA-1: 0c015761ad68a8a2fcd576ce67dc82775995a856
• MD5: f78d7593dd6bad90fd32430ed0b0dcd5
• ssdeep: 1536:61a6KB+7FnPEJLYPuQGlJosWm86MjI4VXxQ+kTWGpOmfYL:8txMOPuNlJo2kyomQ
• TLSH: T1E437BEF361ABED8C734B8B4365E6029C615ED7882132EB54508CBA7CC87897CBF14A51
• Submitted as: wusosidirosirivode.pdf
• File type: pdf · Size: 74979 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://zerosquareonline.com/file/80350973984.pdf, http://mazdooradda.com/userfiles/file/93243036145.pdf, http://absolutelyneon.com/userfiles/file/mulujamepu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=the+definition+of+reproof
• http://zerosquareonline.com/file/80350973984.pdf
• http://mazdooradda.com/userfiles/file/93243036145.pdf
• http://absolutelyneon.com/userfiles/file/mulujamepu.pdf
• https://ols.lighting/wp-content/plugins/super-forms/uploads/php/files/ccee12edba8de43c9d1ad223ac09973f/xagaseloxopug.pdf
• http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16085df708c687---bimuto.pdf
• https://dtcprojects.com.au/wp-content/plugins/super-forms/uploads/php/files/r4i3ftfropkor6ri66llc99qnl/77078215141.pdf
• https://siphouse96.com/wp-content/plugins/super-forms/uploads/php/files/2883f4052602f2fe7021bb340922a305/77451910074.pdf
• http://wellogo.in/userfiles/file///tikajoli.pdf
• http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c032b494a3c---bekaxakib.pdf
• http://hwayinn.com/image/files/20210615_214218.pdf
• http://www.jobsincrete.gr/images/_user_na/file/sabavizuwegelerilonisa.pdf
• https://www.waterlooarmsnewforest.co.uk/wp-content/plugins/super-forms/uploads/php/files/b3436a14eceb1b5e462c2dd6c98e29e6/dufufusenijenepogono.pdf
• https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608468d9dd1b7---lafofasiboduxarod.pdf
• https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/efb259dc822df7eae260f6bd1d75e022/96136602953.pdf
• http://harryreichert.de/uploaded_pics/News/file/mokapudavodidikeg.pdf
• http://www.deep2001.com/images/library/File/60042075100.pdf
• http://debandhelder.nl/ckfinder/userfiles/files/vojaviwemufodizivad.pdf
• https://www.ferienhof-schneider.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607037fc4d559---falujatemokonafododupu.pdf
• http://botanicgardenscafe.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1606fdd6be3195---nejopupejukopabebe.pdf
• https://ht-cooling-j3t.com/contents//files/vubafijotipirano.pdf
• http://saamfactory.com/wp-content/plugins/super-forms/uploads/php/files/613695256ec6551e7b55a9e4b43bd7b8/pevanunugukurozowelaxabom.pdf
• http://kamerton.nl/clientfiles/73733973135.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• feedproxy.google.com
• zerosquareonline.com
• mazdooradda.com
• absolutelyneon.com
• steclotildehorton.ca
• dtcprojects.com.au
• siphouse96.com
• wellogo.in
• www.nbrownies.com.br
• hwayinn.com
• www.waterlooarmsnewforest.co.uk
• costumeworld.com
• swimproject.eu
• harryreichert.de
• www.deep2001.com
• debandhelder.nl
• www.ferienhof-schneider.de
• botanicgardenscafe.com.au
• ht-cooling-j3t.com
• saamfactory.com
• kamerton.nl
• www.w3.org
• purl.org
• ns.adobe.com
• ols.lighting

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report