MALICIOUS — jasawodanotivabikum.pdf

MALICIOUS — jasawodanotivabikum.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 271fb9149e9b0895fa90e03d364946b02f8321e05bf1daaefe583e88e85c79d0
• SHA-1: e3caa6a515b7b3144e721d6b9cef44a250250290
• MD5: 066876ab01f5bcf7f6f5f20b4e3519c2
• ssdeep: 1536:aCZcUr8p+C+NhO7CIKecuo0LbeTe41PqbDBAqJW1/zSgQml5BCKM+nhWmpOS9wg:HcU4YN0/86+/1+BH4Ogll5BCUniS9
• TLSH: T17E39D1F36263DD4C735AEB0359E611B4A48AD74C5223DB608488B77CD8BCA7DBE00642
• Submitted as: jasawodanotivabikum.pdf
• File type: pdf · Size: 89799 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://clinicaveterinariacene.com/userfiles/files/58880734545.pdf, http://smartarts.bg/userfiles/file/povinanujawuwigoxatusal.pdf, https://abril.pe/wp-content/plugins/super-forms/uploads/php/files/p4f6237etml5cgke2fr8o3bb84/jeseniwaxilikawitegenure.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=unarc.dll+returned+an+error+code+11+gta+5
• http://clinicaveterinariacene.com/userfiles/files/58880734545.pdf
• http://smartarts.bg/userfiles/file/povinanujawuwigoxatusal.pdf
• https://abril.pe/wp-content/plugins/super-forms/uploads/php/files/p4f6237etml5cgke2fr8o3bb84/jeseniwaxilikawitegenure.pdf
• https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/3fe918fdfe342a35e4824dd1b2c4bc0d/kezofoletu.pdf
• https://sirikulsteel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8e82eba3d0---91361444353.pdf
• http://herodumpsterrental.com/wp-content/plugins/super-forms/uploads/php/files/70dbfaa51345ad90d5878a052a59a4f9/49426765695.pdf
• https://arhometutor.com/userfiles/file/gozurimazifowudaratokoxe.pdf
• https://stratasphere.online/userfiles/file/lodevodezasomatikazurajo.pdf
• http://gardatrans.com/content/Files/sunazokovunekip.pdf
• https://blagoustroystvo24.ru/ckfinder/userfiles/files/75179575996.pdf
• http://marta-galan.com/files/varios/file/surusezirugedub.pdf
• http://sllight.ru/design/img/upload/file/42937816903.pdf
• https://mttrasportisrl.it/dati/upload/file/winokumer.pdf
• http://tweedehandswikkelaar.nl/app/webroot/files/userfiles/files/panujofegaxoxewositu.pdf
• https://swotin.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084d536bf9ab---73767679323.pdf
• http://ilovegabal.net/fckeditor/_upload/file/molirajolodokeriw.pdf
• http://massvt.sk/editor_uploads/system/files/15897527014.pdf
• http://amandatravel.com/userfiles/file/tifipu.pdf
• https://transport-vehicules.fr/userfiles/file/28274163880.pdf
• https://reazfarah.com/ckfinder/userfiles/files/dulupasujokupok.pdf
• http://anhuizhkj.com/upload_fck/file/2021-4-29/20210429222606961686.pdf
• https://www.northernillumination.com/wp-content/plugins/super-forms/uploads/php/files/01d52e334672104f206b7992db595eec/gujedonunajogazofod.pdf
• http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16085ca6f2862e---bamujudokupafatudupotebaj.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• feedproxy.google.com
• clinicaveterinariacene.com
• agilitynd.com
• sirikulsteel.com
• herodumpsterrental.com
• arhometutor.com
• stratasphere.online
• gardatrans.com
• blagoustroystvo24.ru
• marta-galan.com
• sllight.ru
• mttrasportisrl.it
• tweedehandswikkelaar.nl
• swotin.com
• ilovegabal.net
• amandatravel.com
• transport-vehicules.fr
• reazfarah.com
• anhuizhkj.com
• www.northernillumination.com
• www.rlktechniek.nl
• www.w3.org
• purl.org
• ns.adobe.com
• smartarts.bg

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report