MALICIOUS — nufuvite.pdf
MALICIOUS — nufuvite.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2a311f5f255379fd766586e45a54770ebf3dec8b480d0ca719cc7a15152804d9 - SHA-1:
10a4b9c013bea9eeef51f5286fd27ce5bbaa7335 - MD5:
689554cd79fc9cc153127f56af80cbfb - ssdeep:
1536:aUMoDbXHw9K4bZBvWAqTXONjGKAb5P1WFVWypOlLIGb/X1LsWHbU7NCu:VMoDb3w9K4lBzLCyFelLIq5DA75 - TLSH:
T18F37C0F321A7ED8C779A9F4399FB049CA08AE7846122EB514088B6BCD97C57DBF00550 - Submitted as: nufuvite.pdf
- File type: pdf · Size: 71409 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://baraanduliaptti.org/userfiles/file/90298632825.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://philabc.ru/uplcv?utm_term=convert+48+ounces+to+liters, http://maekalocal.com/Maeka/UserFiles/File/xawekuveje.pdf, https://cplastik.cz/data/cms/file/12565574117.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://philabc.ru/uplcv?utm_term=convert+48+ounces+to+liters
- http://maekalocal.com/Maeka/UserFiles/File/xawekuveje.pdf
- https://cplastik.cz/data/cms/file/12565574117.pdf
- https://dodatkireklamowe.pl/web/uploads/files/79600954129.pdf
- http://foire-fromages-et-vins.com/wp-content/plugins/formcraft/file-upload/server/content/files/16130853901a5d---14031183332.pdf
- http://baraanduliaptti.org/userfiles/file/90298632825.pdf
- https://www.cfo-search.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613205e2722c0---kobabinibepefonimef.pdf
- http://tweddlefoto.com/files_contenidos/upload/files/sakusa.pdf
- https://www.pietri-automobiles.com/wp-content/plugins/super-forms/uploads/php/files/ep3jp55hgei91t9de27vhgsurn/18760834610.pdf
- http://ilksolar.com/Images/Media/files/kenamosupur.pdf
- http://nguyenphat.com/public/default/ckeditor/files/69381489390.pdf
- http://kp-technik.cz/ckfinder/userfiles/files/83865418126.pdf
- http://plkorea77.com/ckupload/files/dixegutatitarifodel.pdf
- http://kirakuramenandsushi.com/uploads/files/zabevekububorofegog.pdf
- http://ingmontagna.com/userfiles/files/vekebiwofa.pdf
- https://burragebrothers.com/demo/jolie/beta/userfiles/files/52978048285.pdf
- http://yodishit.com/uploads/userfiles/file/86292109410.pdf
- https://xtremefitksa.com/ckfinder/userfiles/files/10789320708.pdf
- http://smelawservice.com/file_media/file_image/file/52115807572.pdf
- https://trichynext.com/wp-content/plugins/super-forms/uploads/php/files/42bc13f641dc45570dcd12f8588b175a/57408210144.pdf
- http://kuehllawpc.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/difatitideper.pdf
- http://studiosantomauro.it/userfiles/files/lokomubunaluj.pdf
- http://giasudaihocsupham.com/Images_upload/files/85787477197.pdf
- http://fairbank-ia.org/admin/ckfinder/userfiles/files/noruburogedasorox.pdf
- http://tekizolasyon.com/ckfinder/userfiles/files/55996149221.pdf
Embedded domains
- philabc.ru
- maekalocal.com
- dodatkireklamowe.pl
- foire-fromages-et-vins.com
- baraanduliaptti.org
- www.cfo-search.com
- tweddlefoto.com
- www.pietri-automobiles.com
- ilksolar.com
- nguyenphat.com
- plkorea77.com
- kirakuramenandsushi.com
- ingmontagna.com
- burragebrothers.com
- yodishit.com
- xtremefitksa.com
- smelawservice.com
- trichynext.com
- kuehllawpc.com
- studiosantomauro.it
- giasudaihocsupham.com
- fairbank-ia.org
- tekizolasyon.com
- wolfgang-photography.com
- cecev.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report