MALICIOUS — lukuwumixuwugoroze.pdf
MALICIOUS — lukuwumixuwugoroze.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
334227a0b351de219562f7ef0bb46b53f6d78abe00cae457a81f76189539123f - SHA-1:
379afc5e87ea6db8ceafc9aaf3a90f246acf8478 - MD5:
9612c23fc088a1a7114634c3170acd63 - ssdeep:
1536:a35uPVjETMri1rEHVsfW0OnQtvBNWXL4tyBq1WspO2CryOWgkbqe3moc40l:TOTMGW0mQtvf6LAzc2dm/ajcf - TLSH:
T12237C0F7319BDD1C779BCB136AAD166C548AE3841172EA6140887A3CC5BC9BDAF00B40 - Submitted as: lukuwumixuwugoroze.pdf
- File type: pdf · Size: 76233 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://poiskvod.ru/images/file/97811591234.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://inwebjor.ru/uplcv?utm_term=chemistry+spiral+review+answers, http://asianaccounting.com/admin/fckeditor/userfiles/file/95537671754.pdf, https://diversifiedhumansolutions.com/wp-content/plugins/super-forms/uploads/php/files/a282e6d23155316b728e5f976addc365/61779941289.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://inwebjor.ru/uplcv?utm_term=chemistry+spiral+review+answers
- http://asianaccounting.com/admin/fckeditor/userfiles/file/95537671754.pdf
- https://diversifiedhumansolutions.com/wp-content/plugins/super-forms/uploads/php/files/a282e6d23155316b728e5f976addc365/61779941289.pdf
- https://eclipsetheaters.com/wp-content/plugins/formcraft/file-upload/server/content/files/160909171b3db0---51193974348.pdf
- http://aaaexpressac.com/userfiles/file/62275053565.pdf
- http://web68s.com/upload/files/xodupatijasiwomu.pdf
- http://poiskvod.ru/images/file/97811591234.pdf
- http://systemsbiology.at/uploads/assets/file/rupupadoxi.pdf
- http://unnatiwelfareorganization.com/ckfinder/userfiles/files/dubopulare.pdf
- http://az4group.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16112dd0533d10---21016639633.pdf
- http://xn--dlek-5qa.com/admin/UserFiles/file/murob.pdf
- http://forter.vn/hinhanh/file/39186050798.pdf
- http://studionegro.net/userfiles/files/tipogodujadokitujug.pdf
- https://beribuket.ru/wp-content/plugins/super-forms/uploads/php/files/761825874f8bb80f29d1b0aad0ded545/jidanajodew.pdf
- http://tantex.org/tantex/tantexuserfiles/file/revetodafesegafez.pdf
- https://portsidestrategies.com/wp-content/plugins/super-forms/uploads/php/files/0157256238a3e5db416aea1b032e640f/lupigutitojade.pdf
- http://ckm-machinery.com/userfiles/files/vewizoxuvunajeneliso.pdf
- http://nsk-nalogov.net/upload/files/48942299525.pdf
- http://thuaphatlailongthanh.com/upload/contentFile/minhchau/file/8921990518.pdf
- http://domainecomps.com/documents/files/45262277295.pdf
- https://nevisnews.com/userfiles/43218940316.pdf
- http://www.elsecretodelolivo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611387493b70c---52752993370.pdf
- http://leguido.net/files/27675826996.pdf
- http://www.advancedevents.ro/wp-content/plugins/formcraft/file-upload/server/content/files/161096d7b6457c---nusetojokufukasuzumetus.pdf
- https://jurad.eu/files/file/novurusibijabikipezi.pdf
Embedded domains
- inwebjor.ru
- asianaccounting.com
- diversifiedhumansolutions.com
- eclipsetheaters.com
- aaaexpressac.com
- web68s.com
- poiskvod.ru
- unnatiwelfareorganization.com
- az4group.com.br
- xn--dlek-5qa.com
- studionegro.net
- beribuket.ru
- tantex.org
- portsidestrategies.com
- ckm-machinery.com
- nsk-nalogov.net
- thuaphatlailongthanh.com
- domainecomps.com
- nevisnews.com
- www.elsecretodelolivo.com
- leguido.net
- jurad.eu
- kgmda.com
- www.fifatravels.com
- www.w3.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report