MALICIOUS — vigoput.pdf
MALICIOUS — vigoput.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.
Identification
- SHA-256:
28427afc565fb466d48c1bfbb3931573b9206fbabda4dad8bd4bb99ecde284b4 - SHA-1:
b18369598156b5d8ea6c433269a086a60563847d - MD5:
22e7a4338ecfb4b5ce30f5b0e1331038 - ssdeep:
1536:onl55lyIYH9ehBS7PU7T4xAbZUO/393sj5TxsJiVv1jmXi:e55u0qET4xAbZTsj7qiVv1jL - TLSH:
T1E936E1F363DBECC8BE4E9B03596E153469CCC698215AD7705888B76C84AC6FD6E00D60 - Submitted as: vigoput.pdf
- File type: pdf · Size: 65468 bytes
- Verdict: malicious (92/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://traffnew.ru/wb?keyword=calligraphy%20script%20font%20free, https://uploads.strikinglycdn.com/files/53d7a76e-db9e-407f-b676-a769daea5d41/79918710429.pdf, https://kutesavakelex.weebly.com/uploads/1/3/4/3/134336058/2330078.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://traffnew.ru/wb?keyword=calligraphy%20script%20font%20free
- https://s3.amazonaws.com/nafibanefexex/51342136252.pdf
- https://uploads.strikinglycdn.com/files/53d7a76e-db9e-407f-b676-a769daea5d41/79918710429.pdf
- https://kutesavakelex.weebly.com/uploads/1/3/4/3/134336058/2330078.pdf
- https://uploads.strikinglycdn.com/files/5fd229cf-765f-4589-9533-e9fb39351170/geometry_book_volume_1_answers.pdf
- https://uploads.strikinglycdn.com/files/38814460-0d5b-452c-a6bf-86b441ac7084/e46_parts_diagrams.pdf
- https://gorijifezavu.weebly.com/uploads/1/3/4/5/134502749/vozupob_maguvebemes_rejojanifila_rumegife.pdf
- https://uploads.strikinglycdn.com/files/def822e9-d8da-4870-b602-d09b3ff8446f/lakosekejo.pdf
- https://uploads.strikinglycdn.com/files/c9bae572-6f55-4f38-960e-e3aaabd6630b/swtor_marksman_pvp_guide.pdf
- https://cdn-cms.f-static.net/uploads/4463788/normal_5fb8804bed303.pdf
- https://s3.amazonaws.com/vovuzize/n_words_for_smart_people.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- traffnew.ru
- s3.amazonaws.com
- uploads.strikinglycdn.com
- kutesavakelex.weebly.com
- gorijifezavu.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report