MALICIOUS — buwifap.pdf

MALICIOUS — buwifap.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 2919393efde9f8e91b52cb44bd40607ebae95538b945a6c4adcf7b34af5f0416
• SHA-1: 32aa54b341f0130bee9b969edaf9e6c8e893faa8
• MD5: 1fae46526e388cf63a42175fc3045c56
• ssdeep: 1536:IxVdCiFs94qcfTNGOdGWkQLqJUzUm9dpLEypnwbJeaa2KWl/SASVoU5:HiFSjET+SzUm9vQy+JbDqASVL
• TLSH: T1BE38CFF36067DE4DB7C76B43BAFA1648684AD2487272EB815480B69CC4BC67DBF40940
• Submitted as: buwifap.pdf
• File type: pdf · Size: 78035 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!1FAE46526E38
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16080284cc218e---xemimuvimukinug.pdf, https://martabaktelor.com/contents//files/xofupetajerafolodivave.pdf, https://tuabogadoangel.com/wp-content/plugins/super-forms/uploads/php/files/9a4f449422ca6c012c3ebdb234f48db6/zulavapuroxe.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=tujhe+chaha+rab+se+jyada+song
• http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16080284cc218e---xemimuvimukinug.pdf
• https://martabaktelor.com/contents//files/xofupetajerafolodivave.pdf
• https://tuabogadoangel.com/wp-content/plugins/super-forms/uploads/php/files/9a4f449422ca6c012c3ebdb234f48db6/zulavapuroxe.pdf
• https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/ep11t2a04ie9htq41i1u130q9f/29178944319.pdf
• https://www.cedicar.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607476f0bafbd---64444940560.pdf
• http://absigorta.come/file/japadowobakuger.pdf
• http://seanmore.com/userData/board/file/83658678344.pdf
• https://123kozijnofferte.nl/wp-content/plugins/super-forms/uploads/php/files/fd7ia1hcftpibpkntgddaj9d26/xuxevipogorunoxumalafovel.pdf
• http://mgmkt.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160ab7caea4040---vovijuxenupo.pdf
• http://israel-aliya.com/wp-content/plugins/super-forms/uploads/php/files/d9ed7cd4af994b4033bdb8092453911e/rutigogatuwog.pdf
• https://dewalt-naradi.cz/media/upload/editor/file/54060491874.pdf
• https://artasedanasingaraja.com/uploadfck/file/dajix.pdf
• http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160d251ce4979e---37653866703.pdf
• https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf0b00c4d1e---21791595890.pdf
• http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be586bc8ff7---20728633481.pdf
• http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c333935bb0---butaxafadoviw.pdf
• https://monuments-msk.ru/wp-content/plugins/super-forms/uploads/php/files/fd0ea90abc06c1074907e9956adc7b91/66687456241.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• www.kissdocs.com.au
• martabaktelor.com
• tuabogadoangel.com
• www.cedicar.com
• seanmore.com
• 123kozijnofferte.nl
• mgmkt.com.br
• israel-aliya.com
• artasedanasingaraja.com
• christianboudreau.com
• hellnocancershow.com
• zawayakw.com
• monuments-msk.ru
• www.w3.org
• purl.org
• ns.adobe.com
• sipare.com.ar
• absigorta.come
• dewalt-naradi.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report