MALICIOUS — wadagelo-lesezedopodaki-velirazure-nirulug.pdf

MALICIOUS — wadagelo-lesezedopodaki-velirazure-nirulug.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

SHA-256: 275d2a70aabf1c94e79f02d5ee7323d729a796ece4f9280fc369de5386b50926
SHA-1: be5b75c023922d29717d21976fa67c8dd8de3d1a
MD5: 4d98c824605b09e64f3057a982362acd
ssdeep: 1536:upboKe4ik5skyVbz5TfD5FzLFdeqlimz1XErq/0wk4Cab:EEK9l5MV/5Tb5FlYmhEro0wk4Z
TLSH: T18D38D0F39057EECCB68B6B437EA31558608DE2883A329B701488777DD06C5BE7E14960
Submitted as: wadagelo-lesezedopodaki-velirazure-nirulug.pdf
File type: pdf · Size: 80929 bytes
Verdict: malicious (92/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!4D98C824605B
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://traffine.ru/wb?keyword=drift%20legends%20real%20car%20racing%20apk%20mod, https://site-1173450.mozfiles.com/files/1173450/position_of_adverbs_exercises_upper_intermediate.pdf, https://cdn.sqhk.co/pixazizaze/liggcDy/space_program_skateboards.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://traffine.ru/wb?keyword=drift%20legends%20real%20car%20racing%20apk%20mod
https://site-1173450.mozfiles.com/files/1173450/position_of_adverbs_exercises_upper_intermediate.pdf
https://cdn.sqhk.co/pixazizaze/liggcDy/space_program_skateboards.pdf
http://wozawexopad.epizy.com/nigomukusomitekonaresiw.pdf
https://site-1172173.mozfiles.com/files/1172173/lightroom_auto_color_correction.pdf
https://site-1168006.mozfiles.com/files/1168006/jivofaxunuxu.pdf
https://cdn.sqhk.co/kisesawaropo/DjcHIXA/offline_music_app_for_ios_6.pdf
http://velavedi.iblogger.org/ranazekadulalikobidobi.pdf
https://cdn.sqhk.co/nivatasob/F15ghqD/ruwobapizivopikiwimi.pdf
http://tupudenijusab.rf.gd/gimajafamedopaku.pdf
https://s3.amazonaws.com/pigolo/counting_stars_lyrics_free.pdf
http://surafupomef.epizy.com/78651621885.pdf
https://s3.amazonaws.com/patotale/value_proposition_canvas_template_word.pdf
https://cdn.sqhk.co/lugizumevemu/hgXL6zU/28350364549.pdf
http://lebozid.epizy.com/71006935691.pdf
https://s3.amazonaws.com/sugowubuf/dsssb_je_answer_key_6_19.pdf
http://zakofuta.66ghz.com/mexican_fender_precision_bass_serial_number_guide.pdf
http://dixolasafu.epizy.com/nubepi.pdf
https://s3.amazonaws.com/xiwevitox/icao_aircraft_performance_database.pdf
https://cdn.sqhk.co/pifixijowoka/higdLlm/k_yamet_kombat_arena_hile.pdf
https://s3.amazonaws.com/kukupunopedon/60856756682.pdf
https://site-1177769.mozfiles.com/files/1177769/68593586027.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/

Embedded domains

traffine.ru
site-1173450.mozfiles.com
cdn.sqhk.co
wozawexopad.epizy.com
site-1172173.mozfiles.com
site-1168006.mozfiles.com
velavedi.iblogger.org
s3.amazonaws.com
surafupomef.epizy.com
lebozid.epizy.com
zakofuta.66ghz.com
dixolasafu.epizy.com
site-1177769.mozfiles.com
www.w3.org
purl.org
ns.adobe.com
tupudenijusab.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report