MALICIOUS — vepezikokopakipuke.pdf
MALICIOUS — vepezikokopakipuke.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2cc06972bcc091a44251ed1fe68be7b5c683f91bf06b255e639df86895e02402 - SHA-1:
f8d508429db01c8671002175e078329a39e2230f - MD5:
51300ab029ce442d51464f0065c20c42 - ssdeep:
1536:dV0PppK23SfODO762VdgV3uC2GUllKWSGXhwe5QuS6nRKWUpO7RKh:cPp7CfOm6GdgV3fUllU6hzRl7y - TLSH:
T11437B0F3609BDD8CB79F9F0359FA0598A08AE7982633DB61508872BC51BC57D3E24510 - Submitted as: vepezikokopakipuke.pdf
- File type: pdf · Size: 73552 bytes
- Verdict: malicious (96/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://kompletucetnictvi.cz/files/file/padofegivafitipavufebogu.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://synerhu.ru/uplcv?utm_term=lulubox+ios+download, http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132369a6e8fb---nefabutonoxifemezafa.pdf, http://kompletucetnictvi.cz/files/file/padofegivafitipavufebogu.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://synerhu.ru/uplcv?utm_term=lulubox+ios+download
- http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132369a6e8fb---nefabutonoxifemezafa.pdf
- http://kompletucetnictvi.cz/files/file/padofegivafitipavufebogu.pdf
- https://canoe.ro/Extras/ckfinder/userfiles/files/kifakanunoletikaneb.pdf
- http://www.ags-sib.ru/ckfinder/userfiles/files/vikuvi.pdf
- http://remont-m.com/userfiles/file/zakewaxawagan.pdf
- http://www.og2c.com/images/file/fagarija.pdf
- http://www.vljainandco.com/userfiles/files/tesumaselane.pdf
- http://planet-for-events.de/userfiles/file/vudekuvijuge.pdf
- https://llbyggodesign.se/UserFiles/files/nojigi.pdf
- http://cutskytools.com/d/files/37918786619.pdf
- http://www.immiflex.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612ed6e4e336f---polumaga.pdf
- https://imagebuzz.net/ckfinder/userfiles/files/giduguzarupomutoles.pdf
- https://rosewoodcity.org/nbloom/fckuploads/file/sexenovakajokige.pdf
- http://diplomat2014.ru/ckfinder/userfiles/files/gafeneduzibosofufarigaw.pdf
- http://discoveryenglish.org/wp-content/plugins/formcraft/file-upload/server/content/files/161354558dbe20---tikoxevefidasesaz.pdf
- http://chamdure.com/DATA/files/38491379552.pdf
- http://indianspringhomes.net/userfiles/files/67002651776.pdf
- http://metafelix.it/userfiles/files/60577666346.pdf
- http://raczcsalad.hu/files/damategixo.pdf
- https://firesystem.ro/imagini_ws/33228662370.pdf
- http://105chers.netsociality.com/upload/files/soligolizibuxijar.pdf
- http://cjmfgxfollow.morefriendship.com/upload/files/muvarabewavut.pdf
- https://sukaunited4d.vip/contents/files/19564279264.pdf
- https://sakura-bashi.com/uploads/files/202109090658227837.pdf
Embedded domains
- synerhu.ru
- www.xpresswedding.com
- www.ags-sib.ru
- remont-m.com
- www.og2c.com
- www.vljainandco.com
- planet-for-events.de
- llbyggodesign.se
- cutskytools.com
- www.immiflex.com
- imagebuzz.net
- rosewoodcity.org
- diplomat2014.ru
- discoveryenglish.org
- chamdure.com
- indianspringhomes.net
- metafelix.it
- 105chers.netsociality.com
- cjmfgxfollow.morefriendship.com
- sukaunited4d.vip
- sakura-bashi.com
- www.w3.org
- purl.org
- ns.adobe.com
- kompletucetnictvi.cz
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report