MALICIOUS — pofuwisovo_buvuraki_juruwo_wigegexowani.pdf

MALICIOUS — pofuwisovo_buvuraki_juruwo_wigegexowani.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 281bc6f56aa988dc82d2ebba6560490812a44f39220ba20e02005c1adfd9eece
• SHA-1: 2499dd5ac9e0f047563f96014a079b7d67e9195c
• MD5: 36948eb2879cb63b9f626d83214db394
• ssdeep: 1536:dDH0OCNVpr71E4lz6dBfY/o6KzEO7T3w883BsCissYFxJEGsdQ:NUOCHprO4+BwFQLTbCi0BEGx
• TLSH: T19638E1F3A1D7CD8CB6492B137AF714647456CB4C12339BB49089AE6CC9B45EDAE24C01
• Submitted as: pofuwisovo_buvuraki_juruwo_wigegexowani.pdf
• File type: pdf · Size: 81736 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!36948EB2879C
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://seumenha.ru/wb?keyword=p90x%20classic%20meal%20plan, http://xeravujowa.epizy.com/bodyguard_2011_full_movie_hd_1080p.pdf, http://suzimisefodude.epizy.com/delete_inquiries_credit_report.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://seumenha.ru/wb?keyword=p90x%20classic%20meal%20plan
• http://xeravujowa.epizy.com/bodyguard_2011_full_movie_hd_1080p.pdf
• http://suzimisefodude.epizy.com/delete_inquiries_credit_report.pdf
• https://s3.amazonaws.com/faduxodiwo/manualidades_para_nios_con_papeles_de_colores.pdf
• http://silapopo.epizy.com/horde_levelling_guide_wotlk.pdf
• http://kopavavabigi.66ghz.com/84888356623.pdf
• https://cdn.sqhk.co/vatomepipiw/hhhfgh5/nazagidabilosidutul.pdf
• http://xteenware.online/math_book_answers_8th_grade5lo89.pdf
• https://cdn.sqhk.co/tedogegez/LoiiEgh/10448524168.pdf
• http://jopanitovoxa.epizy.com/59131714453.pdf
• http://copyrightram.net/free_online_games_for_kids_no_download_robloxw1gt6.pdf
• http://mangalvpodarok.ru/nazofexukexbpru1.pdf
• https://cdn.sqhk.co/wugunifikezu/ChbdNWt/forest_hd_wallpapers_4k.pdf
• http://pelebirepopo.onlinewebshop.net/80922627708.pdf
• http://latencfsrt.space/loberutinenopot4wbsp.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• seumenha.ru
• xeravujowa.epizy.com
• suzimisefodude.epizy.com
• s3.amazonaws.com
• silapopo.epizy.com
• kopavavabigi.66ghz.com
• cdn.sqhk.co
• xteenware.online
• jopanitovoxa.epizy.com
• copyrightram.net
• mangalvpodarok.ru
• pelebirepopo.onlinewebshop.net
• latencfsrt.space
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report