MALICIOUS — kekukegazobixof.pdf

MALICIOUS — kekukegazobixof.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

SHA-256: 22230492bb14952ba6d2c77a2eb800c0d5385dc67fd27de02273bc9ffd193646
SHA-1: 09ed80419122d54f5b70a0b28d9a8bc53e7f173d
MD5: dacbdb986dddc7f42b0c9dc2db63e199
ssdeep: 1536:lc5EU6X7jbKqGKu6/xVsL0zSIKFQxWWiPuMI7dBh3GjWcpOmJe9:m516jbKVKuSsL0zSIKFQri2MI7dBh3/F
TLSH: T1F937BFF31083DD5C768B9F476DEB11A8558AEB886222EB9500C8B6ACC47C17DBF04B10
Submitted as: kekukegazobixof.pdf
File type: pdf · Size: 75852 bytes
Verdict: malicious (92/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://bazk.info/public_htmluploads/file/82169445754.pdf, http://mastera-mix.ru/ckfinder/userfiles/files/68291763420.pdf, https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/fb0afd6ba26af9047538ef66f9347b15/kovuvevalefurinetavituju.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

none

Embedded URLs

https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=best+website+for+free+movies+and+tv+shows
https://bazk.info/public_htmluploads/file/82169445754.pdf
http://mastera-mix.ru/ckfinder/userfiles/files/68291763420.pdf
https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/fb0afd6ba26af9047538ef66f9347b15/kovuvevalefurinetavituju.pdf
http://fpole.ru/sadm_files/5065912748.pdf
http://youandisagenix.com/ckfinder/userfiles/files/41961340594.pdf
http://pozitron-s.ru/userfiles/file/95416772865.pdf
https://webmenuplus.com/images/file/gutelunavejesivevuza.pdf
http://adhunikjewellers.com/ckfinder/userfiles/files/nukadikekoteveb.pdf
http://intersonik.eu/upload/files/83788881004.pdf
http://qdcmd.com/data/files/kosewirozenojesiregamofu.pdf
http://libertyquad72.fr/userfiles/file/vudubon.pdf
http://antik-cafe-bergen.de/wp-content/plugins/formcraft/file-upload/server/content/files/16142b80401ce2---rotugezuremenokigega.pdf
https://cancelaria.pl/galeria/file/ripoguwexumebedu.pdf
http://trunglam.vn/uploads/userfiles/file/wuwidutekugoxesudulo.pdf
http://ventexevent.se/uploads/file/29099756947.pdf
http://costruzionibulagna.it/userfiles/files/11428750800.pdf
http://freemansphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613dbf842802b---vovutuwuriva.pdf
http://yetisirkaucuk.com/firma/files/7670667951.pdf
http://phupmirpol.pl/userfiles/file/12421065758.pdf
http://lovesenergy.nl/file/89412067939.pdf
http://ganteltechnology.com/system/userfiles/file/pufevabafibofinogezebot.pdf
http://www.sname.org.tw/sname/ckfinder/userfiles/files/fopevogadakal.pdf
http://savemaxint.com/files/file/dixuzapixeboxuwe.pdf
https://teamcode.net/upload/files/44504794897.pdf

Embedded domains

feedproxy.google.com
bazk.info
mastera-mix.ru
mkting.com.co
fpole.ru
youandisagenix.com
pozitron-s.ru
webmenuplus.com
adhunikjewellers.com
intersonik.eu
qdcmd.com
libertyquad72.fr
antik-cafe-bergen.de
cancelaria.pl
ventexevent.se
costruzionibulagna.it
freemansphotography.com
yetisirkaucuk.com
phupmirpol.pl
lovesenergy.nl
ganteltechnology.com
www.sname.org.tw
savemaxint.com
teamcode.net
www.w3.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report