MALICIOUS — jexepilesosolomobus.pdf

MALICIOUS — jexepilesosolomobus.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 1d905fb1e25a485f68cb984c82a0cdc4baa68264a5938094b4ea004ba6b0a7f3
• SHA-1: 11a30d146c70ad12d04e067d74d10af0951be5d4
• MD5: 5d669cca57944507af7eb77d47e81140
• ssdeep: 1536:sBF0U2IswrvsPGLrJgGirb3ZErFhxpdmlEzJ4hWOpOaZEWGXPHqhejpLd:msIs+vtrJEH3udNJ4aaZIPMelh
• TLSH: T14539CFF73187DC5CB78EDB03BAEF115D918AD78C3172A69140C8A62C94785BDAF01A11
• Submitted as: jexepilesosolomobus.pdf
• File type: pdf · Size: 86679 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://www.lesson-online.org/wp-content/plugins/super-forms/uploads/php/files/4s5tu7ehqgk5r967ubjpgjpha7/66398696702.pdf, http://cloverpark1961.com/clients/6/6a/6a73a08bb68f643008adb5efbbb44e43/File/38399026192.pdf, https://coloreverything.love/wp-content/plugins/super-forms/uploads/php/files/1051866b2af2e9759799bae22b7e2085/49871790291.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/A3Ryygt5BCM/uplcv?utm_term=small+ischemic+changes
• https://www.lesson-online.org/wp-content/plugins/super-forms/uploads/php/files/4s5tu7ehqgk5r967ubjpgjpha7/66398696702.pdf
• http://cloverpark1961.com/clients/6/6a/6a73a08bb68f643008adb5efbbb44e43/File/38399026192.pdf
• https://coloreverything.love/wp-content/plugins/super-forms/uploads/php/files/1051866b2af2e9759799bae22b7e2085/49871790291.pdf
• http://cuatro-pr.org/sites/default/files/file/zufuwilepuvuzeseku.pdf
• https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/160849c345324f---gudomemiviluderoxob.pdf
• http://starlightcelebrates.org/clients/4/43/43e9139217482d7666ce300faf566241/File/75523719601.pdf
• https://unique.global/wp-content/plugins/super-forms/uploads/php/files/05db9b7b80fc5a466a53991f587f29db/45570053737.pdf
• http://elfuklid.cz/foto/Image/file/57304776484.pdf
• http://stl-hk.net/userfiles/30369554272.pdf
• https://sensesgrouphk.com/louis/STARKGROUP/ckfinder/userfiles/files/weravivozixi.pdf
• http://www.argentum.com/wp-content/plugins/super-forms/uploads/php/files/4pn9rhlgne16r8q9s7cojasupp/50613248478.pdf
• https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/cceea811495a0e19ea8b29085d650d01/4319364627.pdf
• http://drvision.org/wp-content/plugins/formcraft/file-upload/server/content/files/16075989dcffb7---46342183904.pdf
• http://progettogeometra.it/userfiles/files/81661426626.pdf
• https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/37c167de99bbc1bb980754e659657cd3/8925465478.pdf
• https://astoriareiki.com/wp-content/plugins/super-forms/uploads/php/files/14c81bda3f33f8dbc4e28c344382d561/17603060020.pdf
• https://www.icslights.com/wp-content/plugins/super-forms/uploads/php/files/d434c4b2653735e06e493458a4faa683/sezifivogaki.pdf
• http://vhs1962.com/clients/b/b9/b967f936f519796c2a696a6ed1da67f9/File/23104597778.pdf
• http://tpdw.pl/userfiles/file/39708735808.pdf
• http://work4shop.cz/userfiles/file/47638994011.pdf
• http://ahkkpcm.org/userfiles/19687053300.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/

Embedded domains

• feedproxy.google.com
• www.lesson-online.org
• cloverpark1961.com
• cuatro-pr.org
• inclinedigital.com
• starlightcelebrates.org
• stl-hk.net
• sensesgrouphk.com
• www.argentum.com
• givemeit.ru
• drvision.org
• progettogeometra.it
• www.lorenzofranzone.it
• astoriareiki.com
• www.icslights.com
• vhs1962.com
• tpdw.pl
• ahkkpcm.org
• www.w3.org
• purl.org
• ns.adobe.com
• coloreverything.love
• unique.global
• elfuklid.cz
• work4shop.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report