MALICIOUS — tasabepikumagomeju.pdf

MALICIOUS — tasabepikumagomeju.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 298df0651494dbd2f82344309c5b6313c5aaa0461808b34c2cfc3f3e739fe03b
• SHA-1: 2c3cd11afbd8634edddb1996a2227505d3c54ebc
• MD5: fdbb5f96b81dd8a7e94d25902fe83816
• ssdeep: 1536:gHHDXRlMtXsIo5cS4q0lf5FgLWzvM1tHp8A4yqfawGA/npnlY1kce:iB08j200/mcOtH2pylwVPpnlY1m
• TLSH: T13337D0F361D7EE9C7AC39B13BCB73829508AD348A1229B5008C8AB5CD5A86FD7D14841
• Submitted as: tasabepikumagomeju.pdf
• File type: pdf · Size: 75585 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!FDBB5F96B81D
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://zajinet.ru/strik?utm_term=what+is+half+life+in+physics, https://uploads.strikinglycdn.com/files/09f45998-838c-42ea-a3a4-38532dcb85d7/52167861202.pdf, https://uploads.strikinglycdn.com/files/80b682d0-c72b-4961-adc4-16948c4fc1c0/40078706197.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://zajinet.ru/strik?utm_term=what+is+half+life+in+physics
• https://uploads.strikinglycdn.com/files/09f45998-838c-42ea-a3a4-38532dcb85d7/52167861202.pdf
• https://uploads.strikinglycdn.com/files/80b682d0-c72b-4961-adc4-16948c4fc1c0/40078706197.pdf
• http://mojikinewosak.22web.org/tozis.pdf
• https://uploads.strikinglycdn.com/files/0e80a228-b50f-42f0-9be5-b63f1a20d628/toro_421_snowblower_oil_change.pdf
• https://cdn.sqhk.co/xetorexevapi/hajf4ew/8107208905.pdf
• https://uploads.strikinglycdn.com/files/f0429d28-ee35-4dd2-a264-12f32eeb48e1/zabeboged.pdf
• http://zelibigevuloxuj.epizy.com/33607137216.pdf
• https://uploads.strikinglycdn.com/files/171a7d1d-7658-4b1a-8c84-037d12d8fb66/63272336274.pdf
• https://uploads.strikinglycdn.com/files/64acb12f-35da-4c26-9eff-3a2cca162c73/get_forklift_certified_online.pdf
• https://uploads.strikinglycdn.com/files/25aa64af-a56c-4661-8f40-1dc658d89f76/60703216635.pdf
• https://uploads.strikinglycdn.com/files/67ba476c-01e1-4a70-b836-247d11a7b791/how_to_fix_a_camera_that_wont_turn_on.pdf
• https://uploads.strikinglycdn.com/files/0b7cfce8-6db8-4ea8-80d3-07d832476e7c/34327258096.pdf
• http://tidegofavinugaw.epizy.com/83696990518.pdf
• https://uploads.strikinglycdn.com/files/7462e877-71fa-4c61-8988-65ca4048daad/94847917941.pdf
• https://uploads.strikinglycdn.com/files/23566453-7714-4877-a6a2-bd4d72fd08e5/gekopavimamimosomumo.pdf
• https://cdn-cms.f-static.net/uploads/4368763/normal_60216e4d1bd9e.pdf
• https://uploads.strikinglycdn.com/files/407eb978-96d5-41e9-88bc-ba088fac861c/star_citizen_worth_it_2020_reddit.pdf
• https://static.s123-cdn-static.com/uploads/4382429/normal_5fe10fd4422cf.pdf
• https://uploads.strikinglycdn.com/files/1301572c-301e-4413-be01-520861dfc7bb/sinudunu.pdf
• https://cdn.sqhk.co/loganidob/aDjfy4i/disney_zombies_2_cast_ages.pdf
• https://cdn.sqhk.co/radofufalam/48giQhz/95413437376.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/

Embedded domains

• zajinet.ru
• uploads.strikinglycdn.com
• mojikinewosak.22web.org
• cdn.sqhk.co
• zelibigevuloxuj.epizy.com
• tidegofavinugaw.epizy.com
• cdn-cms.f-static.net
• static.s123-cdn-static.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report