MALICIOUS — wefiwijire.pdf

MALICIOUS — wefiwijire.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 15fc856f6ff828228bc74ac3c14c8574efd5a7f8a3eb604e038e101ddbfcfb79
• SHA-1: 4c628c98a60f07c8268b6b3372ef5336982481a8
• MD5: 8171a2868fda527700ebbe3f496c56bd
• ssdeep: 1536:Jzu7L4DH6OgrhV/bUgDt2B7x+cLoYIZ5qX2WypOlWWxfnqJaT1cswsIMW:Ef4DaOgLbUMcB7x+AXXlDfvTuW8
• TLSH: T1D83AE0F72097EE5C7B89CF037AAA11D8B149EBD82462DE140089B67DD0BCA7D7E04412
• Submitted as: wefiwijire.pdf
• File type: pdf · Size: 96731 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://tcufroghouses.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613905a97d3ed---kajolemukifadonuki.pdf, https://oneremote.ru/wp-content/plugins/super-forms/uploads/php/files/cc7f3e1d08d0379a99ec66a5bb590c5a/jinusixegoredukojuga.pdf, http://stsaischoolamritsar.com/slbdavbatala/userfiles/file/78131267826.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=reset+lock+screen+password+android+device+manager
• https://tcufroghouses.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613905a97d3ed---kajolemukifadonuki.pdf
• https://oneremote.ru/wp-content/plugins/super-forms/uploads/php/files/cc7f3e1d08d0379a99ec66a5bb590c5a/jinusixegoredukojuga.pdf
• http://stsaischoolamritsar.com/slbdavbatala/userfiles/file/78131267826.pdf
• http://kanoonkaraj.ir/dbmanager/filebank/htmlgallery/file///nitetabul.pdf
• https://www.totspotdaynursery.co.uk/ckfinder/userfiles/files/gefamexufufemadi.pdf
• https://asharfilalkulfi.com/ckfinder/userfiles/files/vexekijaj.pdf
• http://antik-cafe-bergen.de/wp-content/plugins/formcraft/file-upload/server/content/files/16139f6c10954c---vuvuk.pdf
• http://ngoinvest.com/uploads/ckfinder/files/xazezijosakevivejeka.pdf
• https://noddy.nu/images/file/13283247221.pdf
• http://skisun.it/userfiles/files/zunudeweredibasezoxadekof.pdf
• http://xn--jt2b56wn0ap2a.com/upload/file/202109051117032999.pdf
• http://wimborst-ceramics.nl/public/view/upload/fckeditor_images/file/temorumutezuxinifobulo.pdf
• http://ourdesign.hk/ckfinder/userfiles/files/dazamuw.pdf
• http://vimar.ua/userfiles/files/mugusavibope.pdf
• https://gdaniec.com/upload/files/wopudinaxi.pdf
• https://truckforceone.com/upload/editor/file/kureridel.pdf
• http://sushigonewildtogo.com/uploads/files/zesomakilupopesiboni.pdf
• http://cameradungphat.com/uploads/files/mivometilibakupejaw.pdf
• http://montex.pro/uploads/userfiles/file/94846079040.pdf
• https://dp-silver.com/userfiles/file/23246033018.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• feedproxy.google.com
• tcufroghouses.com
• oneremote.ru
• stsaischoolamritsar.com
• kanoonkaraj.ir
• www.totspotdaynursery.co.uk
• asharfilalkulfi.com
• antik-cafe-bergen.de
• ngoinvest.com
• skisun.it
• xn--jt2b56wn0ap2a.com
• wimborst-ceramics.nl
• ourdesign.hk
• vimar.ua
• gdaniec.com
• truckforceone.com
• sushigonewildtogo.com
• cameradungphat.com
• montex.pro
• dp-silver.com
• www.w3.org
• purl.org
• ns.adobe.com
• noddy.nu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report